PatchSiren

PatchSiren cyber security CVE debrief

CVE-2015-8976 Mybb CVE debrief

CVE-2015-8976 is a cross-site scripting (XSS) issue in MyBB and MyBB Merge System that can let a remote attacker inject arbitrary web script or HTML through vectors related to old upgrade files. NVD rates the issue as medium severity (CVSS 6.1) with network access, low attack complexity, no privileges, and required user interaction. The affected versions listed in the corpus are MyBB before 1.6.18, MyBB 1.8.0 through 1.8.5, and MyBB Merge System before 1.8.6.

Vendor
Mybb
Product
Merge System
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Administrators running MyBB forums, teams maintaining MyBB Merge System deployments, and security responders responsible for reviewing legacy upgrade artifacts or public-facing web content should prioritize this issue.

Technical summary

The published record identifies CWE-79 (XSS). The vulnerability is tied to "old upgrade files," indicating that stale or exposed upgrade-related resources can be leveraged to inject script or HTML into a victim’s browser. NVD’s vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows that exploitation is remotely reachable but depends on user interaction and has impact limited to confidentiality and integrity rather than availability. The corpus does not include exploit details or a deeper root-cause write-up, so the safest interpretation is that exposure of upgrade files or remnants from an older upgrade path can create an XSS entry point in affected releases.

Defensive priority

Medium. The issue is public, remotely reachable, and affects user-facing web applications, but it requires user interaction and is not rated as high severity in the supplied data.

Recommended defensive actions

  • Upgrade MyBB to 1.6.18 or later, and 1.8.x to 1.8.6 or later; upgrade MyBB Merge System to 1.8.6 or later.
  • Search for and remove or restrict access to any old upgrade files or other legacy installer/upgrade artifacts exposed on the web server.
  • Review affected forum pages and upgrade-related paths for unexpected script or HTML injection behavior.
  • If immediate upgrading is not possible, apply temporary access restrictions to legacy upgrade resources and monitor for anomalous requests.
  • Validate that deployment and backup processes do not reintroduce old upgrade files after remediation.

Evidence notes

All factual statements above are grounded in the supplied NVD record and the vendor release note reference. The corpus explicitly lists the affected version ranges, the CWE-79 classification, and the CVSS 3.0 vector. References include the MyBB release notes and security mailing list threads, but the corpus does not provide exploit code, proof-of-concept details, or additional technical root-cause analysis.

Sources and references

Verified primary and authoritative sources

  • CVE-2015-8976 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2015-8976

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2015-8976 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2015-8976

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.