CVE-2015-8977

MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.

• CWE-532

• http://www.openwall.com/lists/oss-security/2016/11/10/8Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94397Third Party Advisory, VDB Entry
• https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/Release Notes, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2016/11/10/8Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94397Third Party Advisory, VDB Entry
• https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/Release Notes, Vendor Advisory

Published

Jan 31, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-8971Terminology 0.7.0 allows remote attackers to execute arbitra…7.8
• CVE-2015-8972Stack-based buffer overflow in the ValidateMove function in …9.8
• CVE-2015-8973xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and …
• CVE-2015-8974SQL injection vulnerability in the Group Promotions module i…
• CVE-2015-8975Cross-site scripting (XSS) vulnerability in the error handle…
• CVE-2015-8976Cross-site scripting (XSS) vulnerability in MyBB (aka MyBull…
• CVE-2015-8978In Soap Lite (aka the SOAP::Lite extension for Perl) 1.14 an…
• CVE-2015-8979Stack-based buffer overflow in the parsePresentationContext …
• CVE-2015-8980The plural form formula in ngettext family of calls in php-g…9.8
• CVE-2015-8981Heap-based buffer overflow in the PdfParser::ReadXRefSubsect…
• CVE-2015-8982Integer overflow in the strxfrm function in the GNU C Librar…
• CVE-2015-8983Integer overflow in the _IO_wstr_overflow function in libio/…