CVE-2006-1775: XSS
Multiple cross-site scripting (XSS) vulnerabilities in phpBB 2.0.19 allow remote attackers to inject arbitrary web script or HTML via the (1) Site Description field in (a) adminboard.php, the (2) Group name and (3) Group description fields in (b) admingroups.php and (c) groupcp.php, the (4) Theme Name field in (d) adminstyles.php, and the (5) Rank Title field in (e) adminranks.php. NOTE: the profile.php/Current password vector is already covered by CVE-2006-1603.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-1775?
CVE-2006-1775 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2006-1775?
To fix CVE-2006-1775, upgrade phpBB to version 2.0.20 or later which includes patches for the identified vulnerabilities.
What types of attacks can be performed using CVE-2006-1775?
CVE-2006-1775 allows attackers to perform cross-site scripting (XSS) attacks, potentially leading to session hijacking or data theft.
Which versions of phpBB are affected by CVE-2006-1775?
CVE-2006-1775 specifically affects phpBB version 2.0.19.
What fields are vulnerable in CVE-2006-1775?
The vulnerable fields in CVE-2006-1775 include the Site Description field, Group name, and Group description fields in specific phpBB admin and group control panels.