CVE-2006-0437: XSS
Published Feb 6, 2006
·Updated
Cross-site scripting (XSS) vulnerability in adminsmilies.php in phpBB 2.0.19 allows remote attackers to inject arbitrary web script or HTML via Javascript events such as "onmouseover" in the (1) smileurl or (2) smileemotion parameters, which bypasses a check for "<" and ">" characters.
Affected Software
17 affected components
Phpbb Group Phpbb=2.0.6c
Phpbb Group Phpbb=2.0.6d
Phpbb Group Phpbb=2.0.7
Phpbb Group Phpbb=2.0.7a
Phpbb Group Phpbb=2.0.8
Phpbb Group Phpbb=2.0.8a
Phpbb Group Phpbb=2.0.9
Phpbb Group Phpbb=2.0.10
Phpbb Group Phpbb=2.0.11
Phpbb Group Phpbb=2.0.12
Phpbb Group Phpbb=2.0.13
Phpbb Group Phpbb=2.0.14
Phpbb Group Phpbb=2.0.15
Phpbb Group Phpbb=2.0.16
Phpbb Group Phpbb=2.0.17
Phpbb Group Phpbb=2.0.18
Phpbb Group Phpbb=2.0.19
Event History
Feb 6, 2006
CVE Published
10:02 PM
Feb 7, 2006
CVE Published
via MITRE·03:00 AM
Data Sourced
via MITRE·03:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-0437?
CVE-2006-0437 is considered a moderate severity vulnerability due to its ability to allow cross-site scripting attacks.
2
How do I fix CVE-2006-0437?
To fix CVE-2006-0437, upgrade phpBB to version 2.0.20 or later, where this vulnerability is patched.
3
What software is affected by CVE-2006-0437?
CVE-2006-0437 affects phpBB versions 2.0.7 to 2.0.19.
4
What type of vulnerability is CVE-2006-0437?
CVE-2006-0437 is a cross-site scripting (XSS) vulnerability.
5
Can I exploit CVE-2006-0437 for phishing attacks?
Yes, CVE-2006-0437 can be exploited to inject malicious scripts that could facilitate phishing attacks.