https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 15:16:50 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-45128 <p>MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator&#39;s default user list view by embedding a specially crafted URL. The Set as Default control named set_default in Admin CP, Users &amp; Groups, Users, View Manager changes the administrator&#39;s default view on GET requests without request forgery protection. The uniquely identifying implementation details include Users &amp; Groups → Users → View Manager, and admin/inc/functions_view_manager.php. This issue is fixed in version 1.8.40.</p> <p>MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator&#39;s default user list view by embedding a specially crafted URL. The Set as Default control named set_default in Admin CP, Users &amp; Groups, Users, View Manager changes the administrator&#39;s default view on GET requests without request forgery protection. The uniquely identifying implementation details include Users &amp; Groups → Users → View Manager, and admin/inc/functions_view_manager.php. This issue is fixed in version 1.8.40.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-45128