CVE-2016-9402 Mybb CVE debrief

Who should care

Administrators and operators of MyBB forums, especially instances running MyBB or MyBB Merge System 1.8.6 or earlier. Security teams responsible for internet-facing community platforms and any system that uses the moderation tool should prioritize this immediately.

Technical summary

NVD classifies the issue as CWE-89 (SQL Injection) with CVSS 3.0 vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerable products listed in the supplied corpus are cpe:2.3:a:mybb:mybb and cpe:2.3:a:mybb:merge_system, both ending at version 1.8.6. The public description states that remote attackers might be able to execute arbitrary SQL commands via unspecified vectors in the moderation tool.

Defensive priority

Critical. The supplied CVSS score is 9.8 and the vector indicates no privileges, no user interaction, and full impact to confidentiality, integrity, and availability. Systems that are reachable over the network should be patched as soon as possible.

Recommended defensive actions

• Upgrade MyBB and MyBB Merge System to 1.8.7 or later as indicated by the NVD vulnerable-version range and vendor release reference.
• Confirm all deployed forum instances are no longer running 1.8.6 or earlier, including merged installations.
• Review moderation-tool access paths and check application and database logs for unexpected queries or tampering around the disclosure window and after.
• If immediate upgrading is not possible, reduce exposure of the affected administrative surface until remediation is complete.
• After patching, validate database integrity and user/admin account states for signs of unauthorized changes.

Evidence notes

The vulnerability description, CVSS vector, weakness type, and affected version range were taken from the supplied NVD record. The record lists two official product criteria as vulnerable through 1.8.6. Reference links in the corpus include NVD, the CVE record, MyBB release notes, and Openwall mailing-list posts. The supplied corpus does not identify a more specific exploit path than 'unspecified vectors,' so this debrief avoids guessing at request parameters or code paths. The CVE was published on 2017-01-31; the 2026 modified timestamp reflects later record maintenance, not original disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.