Re: Multiple vulnerabilities in MyBB

0
34

Posted by Andrew Farmer on Apr 23

You're kidding, right?

Revealing the names of forum users is practically core functionality. There's no expectation whatsoever that they be
kept secret – they're displayed all over the site, and a member list (giving you the ability to download ALL USER NAMES
ON THE FORUM OMG) is enabled by default.

The first one requires an activation code sent by email. I suppose you could *try* to brute-force it, but you'd
probably…

Source: Re: Multiple vulnerabilities in MyBB