What’s Vulnerable › Vulnerabilities

CVE-2025-29457

• Severity: high (CVSS 7.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-04-17 · updated 2026-06-17
• Weakness: CWE-918

Description

An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. NOTE: the Supplier disputes this because of the allowed actions of Board administrators and because of SSRF mitigation.

Affected products

• mybb: 1.8.38

References

• https://docs.mybb.com/1.8/administration/security/protection/#limit-access-to-private-hosts-and-ip-addresses
• https://www.yuque.com/morysummer/vx41bz/vro4dvxzuiwlg6uv

Get alerted when CVE-2025-29457 or the next vulnerability affects your stack