CVE-2006-0959: Mybulletinboard

High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days.

SQL injection vulnerability in misc.php in MyBulletinBoard (MyBB) 1.03, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands by setting the comma variable value via the comma parameter in a cookie. NOTE: 1.04 has also been reported to be affected.

Affected products

• Mybulletinboard Mybulletinboard: version 1.0.3 only; version 1.0.4 only

Published 2006-03-02. Last modified 2026-06-16.