PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9406 Mybb CVE debrief

CVE-2016-9406 is a cross-site scripting (XSS) issue in the MyBB user control panel. According to the public record, it affects MyBB and MyBB Merge System before 1.8.7 and may allow a remote attacker to inject arbitrary web script or HTML through unspecified vectors. NVD classifies it as CWE-79 with network attackability, no privileges required, but user interaction required.

Vendor
Mybb
Product
Merge System
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Administrators and operators running MyBB or MyBB Merge System versions before 1.8.7, especially public-facing forum deployments and sites that expose the user control panel to end users.

Technical summary

NVD lists this as CWE-79 with CVSS 3.0 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The affected CPEs include MyBB and MyBB Merge System through version 1.8.6. The public description does not specify the exact injection path, so the safest interpretation is a user-facing XSS condition in the control panel area that can enable script or HTML injection when a victim interacts with the affected content.

Defensive priority

Medium overall, but higher for internet-facing forums or deployments with active user control panel usage. The CVSS score is 6.1 and the issue requires user interaction, yet XSS can still support session theft, content manipulation, or phishing-style abuse.

Recommended defensive actions

  • Upgrade MyBB and MyBB Merge System to 1.8.7 or later.
  • Review the vendor release notes and associated advisories for the 1.8.7 fixes.
  • Audit custom themes, plugins, and templates for output encoding and HTML sanitization issues around the user control panel.
  • Check the user control panel and related profile fields for unexpected script or HTML content.
  • If compromise is suspected, invalidate active sessions and review authentication-related logs.
  • Track vendor security announcements and apply future forum software updates promptly.

Evidence notes

This debrief is based on the NVD CVE record, which supplies the CVSS vector, CWE-79 mapping, and vulnerable version range through 1.8.6, plus the linked vendor release notes and public mailing-list references. The public record does not provide the exact exploit path, so the summary avoids assuming a specific injection mechanism beyond XSS in the user control panel.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9406 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9406

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9406 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9406

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.