PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9410 Mybb CVE debrief

CVE-2016-9410 is a high-severity information disclosure issue affecting MyBB (MyBulletinBoard) and MyBB Merge System before 1.8.7. The public record says remote attackers might obtain sensitive database information through template-related vectors. NVD maps the weakness to CWE-200 and rates the issue as network-exploitable with no privileges or user interaction required.

Vendor
Mybb
Product
Merge System
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-31
Original CVE updated
2026-05-13
Advisory published
2017-01-31
Advisory updated
2026-05-13

Who should care

Administrators and security teams running MyBB or MyBB Merge System versions 1.8.6 and earlier should treat this as relevant, especially for internet-facing forum deployments and any environment that stores sensitive data in the application database.

Technical summary

The NVD record describes a remote confidentiality issue in MyBB and MyBB Merge System before 1.8.7. The affected version criteria in the record extend through 1.8.6. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a remotely reachable issue with low attack complexity, no authentication, and a high confidentiality impact but no stated integrity or availability impact. The weakness is categorized as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Defensive priority

High

Recommended defensive actions

  • Upgrade MyBB and MyBB Merge System to 1.8.7 or later.
  • Inventory all forum and merge-system instances to confirm no 1.8.6-or-earlier deployments remain.
  • Review custom templates and related extensions for any exposure of database-sensitive data.
  • If sensitive information may have been exposed, assess whether credential or data rotation is warranted.
  • Validate the patch state against the vendor advisory and your deployment baseline before returning the service to normal operation.

Evidence notes

This debrief is based only on the supplied NVD/CVE corpus and the linked official or cited references. The NVD record provides the vulnerability description, affected version criteria, CVSS vector, and CWE classification. The reference list also includes mailing-list patch references and a MyBB vendor blog advisory/release reference. No exploit code or unverified root-cause details are included here.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9410 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9410

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9410 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9410

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.