CVE-2022-39265

CVE-2022-39265 is a high-severity vulnerability affecting MyBB forum software versions prior to 1.8.31. It allows for Remote Code Execution (RCE) and sensitive information disclosure through the mail_parameters setting in the Admin CP, specifically within the "Additional Parameters for PHP's mail() function." Exploitation requires administrator privileges with specific permissions and depends on the mail program's configuration and file permissions. The CVSS score is 7.2 (HIGH), indicating a network-based attack with high impact on confidentiality, integrity, and availability. There is no known active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.