CVE-2011-10018
CRITICALCVSS v3
9.8
CRITICAL
EPSS Score
53.0%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted collapsed cookie. This vulnerability was introduced during packaging and was not part of the intended application logic. Exploitation requires no authentication and results in full compromise of the web server under the context of the web application.
Technical Details
- Published
- 8/13/2025
Frequently Asked Questions
What is CVE-2011-10018?
myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted collapsed cookie. This vulnerability was introduced during packaging and was not part of the intended application logic. Exploitation requires no authentication and results in full compromise of the web server under the context of the web application.
Is CVE-2011-10018 actively exploited?
Active exploitation of CVE-2011-10018 has not been confirmed. The EPSS score is 53.0%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2011-10018?
CVE-2011-10018 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2011-10018 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.