CVE-2006-4706
5.7 Medium
AI Score
Confidence
High
6.8 Medium
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.035 Low
EPSS
Percentile
91.5%
Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via a url BBCode tag that contains a javascript URI with an SGML numeric character reference and an embedded space, as demonstrated using “java& #115;cript,” a different vulnerability than CVE-2006-3761.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| mybulletinboard:mybulletinboard | mybulletinboard | eq | 1.1.7 |
References
myimei.com/security/2006-08-15/mybb-117-htmlspeacialchar_uni-fixjavascript-functions_postphp-urlxss-attack.html
secunia.com/advisories/21697
securityreason.com/securityalert/1541
www.mybboard.com/archive.php?nid=18
www.securityfocus.com/archive/1/444807/100/100/threaded
www.vupen.com/english/advisories/2006/3418
Related
5.7 Medium
AI Score
Confidence
High
6.8 Medium
CVSS2
Access Vector
Access Complexity
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.035 Low
EPSS
Percentile
91.5%