CVE-2006-1281: XSS
Cross-site scripting (XSS) vulnerability in member.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vulnerability than CVE-2006-1272. NOTE: 1.10 was later reported to be vulnerable.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-1281?
CVE-2006-1281 is classified as a cross-site scripting (XSS) vulnerability which poses medium severity as it allows remote attackers to inject arbitrary web scripts or HTML.
How do I fix CVE-2006-1281?
To fix CVE-2006-1281, update MyBulletinBoard to a version that is not vulnerable, preferably version 1.10 or later.
Which versions of MyBulletinBoard are affected by CVE-2006-1281?
CVE-2006-1281 affects MyBulletinBoard versions 1.0_final, rc1, rc2, rc3, rc4, and 1.0.1 to 1.0.4.
Can CVE-2006-1281 lead to data theft?
Yes, CVE-2006-1281 can lead to data theft as attackers can exploit the XSS vulnerability to steal session cookies or other sensitive information.
How can I identify if my MyBulletinBoard installation is vulnerable to CVE-2006-1281?
You can identify vulnerability to CVE-2006-1281 by checking if your MyBulletinBoard version is one of the affected releases and testing for XSS exploitation via the url parameter.