Vulnerability Details CVE-2006-0437
Cross-site scripting (XSS) vulnerability in admin_smilies.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as "onmouseover" in the (1) smile_url or (2) smile_emotion parameters, which bypasses a check for "<" and ">" characters.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 72.0%
CVSS Severity
CVSS v2 Score 4.3
References
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041920.html
- http://secunia.com/advisories/18693
- http://securityreason.com/achievement_securityalert/31
- http://securityreason.com/securityalert/406
- http://www.osvdb.org/22928
- http://www.vupen.com/english/advisories/2006/0445
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24497
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-February/041920.html
- http://secunia.com/advisories/18693
- http://securityreason.com/achievement_securityalert/31
- http://securityreason.com/securityalert/406
- http://www.osvdb.org/22928
- http://www.vupen.com/english/advisories/2006/0445
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24497
Products affected by CVE-2006-0437
-
cpe:2.3:a:phpbb_group:phpbb:2.0.10
-
cpe:2.3:a:phpbb_group:phpbb:2.0.11
-
cpe:2.3:a:phpbb_group:phpbb:2.0.12
-
cpe:2.3:a:phpbb_group:phpbb:2.0.13
-
cpe:2.3:a:phpbb_group:phpbb:2.0.14
-
cpe:2.3:a:phpbb_group:phpbb:2.0.15
-
cpe:2.3:a:phpbb_group:phpbb:2.0.16
-
cpe:2.3:a:phpbb_group:phpbb:2.0.17
-
cpe:2.3:a:phpbb_group:phpbb:2.0.18
-
cpe:2.3:a:phpbb_group:phpbb:2.0.19
-
cpe:2.3:a:phpbb_group:phpbb:2.0.6c
-
cpe:2.3:a:phpbb_group:phpbb:2.0.6d
-
cpe:2.3:a:phpbb_group:phpbb:2.0.7
-
cpe:2.3:a:phpbb_group:phpbb:2.0.7a
-
cpe:2.3:a:phpbb_group:phpbb:2.0.8
-
cpe:2.3:a:phpbb_group:phpbb:2.0.8a
-
cpe:2.3:a:phpbb_group:phpbb:2.0.9