Servers and applications
CVE-2019-12831
In MyBB before 1.8.21, an attacker can abuse a default behavior of MySQL on many systems (that leads to truncation of strings that are too long for a database column) to create a PHP shell in the cache directory of a targeted forum via a crafted XML import, as demonstrated by truncation of aaaaaaaaaaaaaaaaaaaaaaaaaa.php.css to aaaaaaaaaaaaaaaaaaaaaaaaaa.php with a 30-character limit, aka theme…
- Severity
- High 7.2
- Published
- 15 Jun 2019
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 1.8.21
- Exploit chance
- 1.5% in the next 30 daysHigher than 73% of CVEs. EPSS by FIRST, 10 Nov 2026
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
MyBBServers and applications · cpe:a:mybb:mybb |
|