Servers and applications

CVE-2016-9415

MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import."

Severity: High 7.5
Published: 31 Jan 2017
Last changed: 17 Jun 2026
Added to UpHeron: 1 Nov 2026
Exploit chance: 1.9% in the next 30 daysHigher than 79% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness: Improper access control (CWE-284)
Attack: Over the network · No login needed · No user action needed
Attacker can: Change data
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Sources: NVD

Affected software

Software	Affected versions
MyBBServers and applications · `cpe:a:mybb:mybb`	Every version up to 1.8.7

References

NVD https://nvd.nist.gov/vuln/detail/CVE-2016-9415
CVE.org https://www.cve.org/CVERecord?id=CVE-2016-9415