CVE-2006-1040: XSS
Published Mar 7, 2006
·Updated
Cross-site scripting (XSS) vulnerability in vBulletin 3.0.12 and 3.5.3 allows remote attackers to inject arbitrary web script or HTML via the email field, which is injected in profile.php but not sanitized in sendmsg.php.
Affected Software
2 affected components
Jelsoft vBulletin=3.0.12
Jelsoft vBulletin=3.5.3
Remediation
Patch Available
Event History
Mar 7, 2006
CVE Published
11:02 AM
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-1040?
CVE-2006-1040 has a medium severity rating due to its potential impact through cross-site scripting attacks.
2
How do I fix CVE-2006-1040?
To fix CVE-2006-1040, you should upgrade vBulletin to a version that addresses the XSS vulnerability.
3
What software versions are affected by CVE-2006-1040?
CVE-2006-1040 affects vBulletin versions 3.0.12 and 3.5.3.
4
Can CVE-2006-1040 be exploited remotely?
Yes, CVE-2006-1040 allows remote attackers to exploit the vulnerability via unsanitized inputs.
5
What type of attack does CVE-2006-1040 facilitate?
CVE-2006-1040 facilitates cross-site scripting (XSS) attacks by allowing injection of arbitrary web scripts.