3rd party plugins are always the usual suspects. Most forum software out now is secure (enough).

@pratham: If it's free it must be bad, right? Nope.

Don't install every 3rd party plugin your users request. I think researching about the plugin updates for your existing plugins, before blindly updating them is also a nice precaution.
What do you think @1llusion?

(07-26-2013, 07:06 PM)Coder-san Wrote: @pratham: If it's free it must be bad, right? Nope.

Don't install every 3rd party plugin your users request. I think researching about the plugin updates for your existing plugins, before blindly updating them is also a nice precaution.
What do you think @1llusion?

Agreed. I spent a lot of time going through MyBB's source code, looking for bugs. There are a few minor things that could be better, but they aren't a serious issue (they won't grant access to any part of the website). MyBB may seem like it is vulnerable to a lot of things simply because it is open-source. Anybody (like me) can inspect the code and usually people write their finding on their blogs. With closed source software you can't do that. For example, did you know, that there were recently fixed critical vulnerabilities in Windows systems? They allowed remote full system access. But since Windows is a closed-source project, only the dev team knows about it and they mentioned it on their updates news, which nobody reads anyway. And by recently, I mean in the last few months.
OpenSource is just more loud. It can't simply hide things.

(07-26-2013, 03:24 PM)1llusion Wrote:

(07-26-2013, 03:12 PM)pratham Wrote:

(07-26-2013, 03:04 PM)1llusion Wrote:

(07-19-2013, 07:07 AM)pratham Wrote: yup... MyBB is freeware but have thousands of exploits...

Show me those "thousands of exploits", from the the time I started to pay attention to MyBB (since 1.6.5/4) I've seen just a few exploits that actually did do something. All of the other "MyBB exploits" are caused by 3rd party plug-ins. MyBB itself is quite secure (I do have some issues with some parts of the code but hey, that is why open-source is so great, I can fix it myself).

I'd go with MyBB, I like to play with the code, the ability to actually see what is going on and in-case there is a bug, I can fix it myself etc. No need to wait for an official patch

EDIT: Feel free to compare the security yourself:
http://www.exploit-db.com/search/?action...ilter_cve=
http://www.exploit-db.com/search/?action...ilter_cve=

nop bro.. have lot of exploits.. u can check on exploit-db and also on Inj3ct0rs.....

Told you, show me the exploits. I just sent you 2 links to exploit-db. The amount of exploits found in MyBB and vBulletin are about the same (vBulletin has one extra page).

Look at the links yourself. Even Inj3ct0rs say the same. Actually, there are more critical vulnerabilities for vBulletin on Inj3ct0r than for MyBB. Have a look yourself.

okay you win...

(07-26-2013, 07:06 PM)Coder-san Wrote: @pratham: If it's free it must be bad, right? Nope.

Don't install every 3rd party plugin your users request. I think researching about the plugin updates for your existing plugins, before blindly updating them is also a nice precaution.
What do you think @1llusion?

yes.. your right... They provide nulled script...