CVE-2006-1205: XSS
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) confirmredirect and (2) postid parameters in (a) delcomment.php, as reachable when mode=delcom from index.php; and the (3) del and (4) message parameters in (b) upload.php, the (5) errormsg parameter in (c) addcat.php, (d) edituser.php, (e) adduser.php, and (f) editcat.php, the (6) trackbackurl parameter in (g) add.php, (7) id parameter in (h) deluser.php, (8) catid parameter in (i) delcat.php, and (9) postid parameter in (j) del.php, as reachable from admin.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-1205?
CVE-2006-1205 is rated as a medium severity vulnerability due to its potential to allow cross-site scripting attacks.
What software versions are affected by CVE-2006-1205?
CVE-2006-1205 affects myWebland myBloggie versions 2.1.2, 2.1.3, and 2.1.3 beta.
How do I fix CVE-2006-1205?
To fix CVE-2006-1205, upgrade to a version of myWebland myBloggie that is not vulnerable, such as later than 2.1.3.
What types of attacks can CVE-2006-1205 facilitate?
CVE-2006-1205 can facilitate cross-site scripting (XSS) attacks, allowing attackers to inject arbitrary web scripts or HTML.
What parameters are involved in CVE-2006-1205 exploitation?
The parameters involved in the exploitation of CVE-2006-1205 are confirmredirect and post_id in the delcomment.php script.