CVE-2018-15596: Mybb

Medium severity, CVSS 6.1. EPSS: 2.3% chance of exploitation in the next 30 days.

An issue was discovered in inc/class_feedgeneration.php in MyBB 1.8.17. On the forum RSS Syndication page, one can generate a URL such as http://localhost/syndication.php?fid=&type=atom1.0&limit=15. The thread titles (within title elements of the generated XML documents) aren't sanitized, leading to XSS.

Affected products

• Mybb Mybb: version 1.8.17 only

Published 2018-08-28. Last modified 2026-06-17.