CVE-2008-2022: Improper Neutralization of Input During Web Page Generation

Mulatiple cross-site scripting XSS vulnerabilities in PD9 Software MegaBBS 2.2 allow remote attackers to inject arbitrary web script or HTML via the 1 toid parameter to send-private-message.asp and the 2 redirect parameter to admin/impersonate.asp. NOTE: vector 2 requires authentication...

CVE-2006-0139: Undefined Security Weakness

The send-private-message functionality send-private-message.asp in PD9 Software MegaBBS 2.1 allows remote attackers to read private messages of other users via a modified replyid parameter...