PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9406 Mybb CVE debrief

CVE-2016-9406 is a cross-site scripting (XSS) issue in the MyBB user control panel. According to the public record, it affects MyBB and MyBB Merge System before 1.8.7 and may allow a remote attacker to inject arbitrary web script or HTML through unspecified vectors. NVD classifies it as CWE-79 with network attackability, no privileges required, but user interaction required.

Vendor
Mybb
Product
CVE-2016-9406
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Administrators and operators running MyBB or MyBB Merge System versions before 1.8.7, especially public-facing forum deployments and sites that expose the user control panel to end users.

Technical summary

NVD lists this as CWE-79 with CVSS 3.0 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The affected CPEs include MyBB and MyBB Merge System through version 1.8.6. The public description does not specify the exact injection path, so the safest interpretation is a user-facing XSS condition in the control panel area that can enable script or HTML injection when a victim interacts with the affected content.

Defensive priority

Medium overall, but higher for internet-facing forums or deployments with active user control panel usage. The CVSS score is 6.1 and the issue requires user interaction, yet XSS can still support session theft, content manipulation, or phishing-style abuse.

Recommended defensive actions

  • Upgrade MyBB and MyBB Merge System to 1.8.7 or later.
  • Review the vendor release notes and associated advisories for the 1.8.7 fixes.
  • Audit custom themes, plugins, and templates for output encoding and HTML sanitization issues around the user control panel.
  • Check the user control panel and related profile fields for unexpected script or HTML content.
  • If compromise is suspected, invalidate active sessions and review authentication-related logs.
  • Track vendor security announcements and apply future forum software updates promptly.

Evidence notes

This debrief is based on the NVD CVE record, which supplies the CVSS vector, CWE-79 mapping, and vulnerable version range through 1.8.6, plus the linked vendor release notes and public mailing-list references. The public record does not provide the exact exploit path, so the summary avoids assuming a specific injection mechanism beyond XSS in the user control panel.

Official resources

CVE published on 2017-01-31T22:59:01.173Z; NVD last modified the record on 2026-05-13T00:24:29.033Z. The public reference set includes vendor release notes, mailing-list references, and a third-party advisory entry.