CVE-2025-29458
CVSS 3.1 Score 7.6 of 10 (high)
Details
Published Apr 17, 2025
Updated: Apr 24, 2025
CWE ID 918
Summary
CVE-2025-29458 is a vulnerability affecting MyBB 1.8.38. This issue grants remote attackers the ability to access sensitive information through the Change Avatar function. However, it's important to note that the vulnerability's legitimacy has been contested by the MyBB supplier due to the permitted actions of Board administrators and the implementation of SSRF mitigation. Despite this dispute, the potential impact of this vulnerability could pose a significant risk if exploited.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- MyBB
Affected Vendors
- myBB