PT-2006-4799 · Mybulletinboard · Mybb

Roozbeh Afrasiabi · Published 2006-08-01 · Updated 2018-10-17 · CVE-2006-3953

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MyBB (aka MyBulletinBoard) version 1.x

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved via the gallery parameter in the usercp.php file.

Recommendations For MyBB (aka MyBulletinBoard) version 1.x, update to a version that fixes this issue, ensuring the gallery parameter in usercp.php is properly sanitized to prevent arbitrary web script or HTML injection.

Exploit

Fix

Related Identifiers

CVE-2006-3953

Affected Products

Mybb

References · 4

• 🔥 http://securityfocus.com/bid/19193 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-3953 · Security Note
• http://securityfocus.com/archive/1/441534/100/0/threaded · Note
• http://securityreason.com/securityalert/1319 · Note