CVE-2006-1281

LowCVSS 3.5/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in member.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to inject arbitrary web script or HTML via the url parameter, a different vulnerability than CVE-2006-1272. NOTE: 1.10 was later reported to be vulnerable.

Metrics

CVSS 2.0 3.5/10AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://community.mybboard.net/showthread.php?tid=7368Patch
http://kapda.ir/advisory-296.htmlExploit, Vendor Advisory
http://myimei.com/security/2006-03-09/mybb104memberphpxss-after-login.htmlExploit
http://secunia.com/advisories/19213Exploit, Patch, Vendor Advisory
http://www.osvdb.org/23935
http://www.securityfocus.com/archive/1/427744/100/0/threaded
http://www.securityfocus.com/bid/17097Exploit
http://www.securityfocus.com/bid/17492Exploit
http://www.vupen.com/english/advisories/2006/0971
https://exchange.xforce.ibmcloud.com/vulnerabilities/25266
http://community.mybboard.net/showthread.php?tid=7368Patch
http://kapda.ir/advisory-296.htmlExploit, Vendor Advisory
http://myimei.com/security/2006-03-09/mybb104memberphpxss-after-login.htmlExploit
http://secunia.com/advisories/19213Exploit, Patch, Vendor Advisory
http://www.osvdb.org/23935
http://www.securityfocus.com/archive/1/427744/100/0/threaded
http://www.securityfocus.com/bid/17097Exploit
http://www.securityfocus.com/bid/17492Exploit
http://www.vupen.com/english/advisories/2006/0971
https://exchange.xforce.ibmcloud.com/vulnerabilities/25266

Timeline

Published: Mar 19, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-12824.3CRLF injection vulnerability in inc/function.php in MyBulletinBoard (MyBB) 1.04 allows remote attackers to conduct cross-site scripting (XSS CVE-2006-12837.2opiepasswd in One-Time Passwords in Everything (OPIE) in FreeBSD 4.10-RELEASE-p22 through 6.1-STABLE before 20060322 uses the getlogin funct CVE-2006-12844.6The installation of SQLAnywhere in Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, includes a default admi CVE-2006-12853.2SQLAnywhere in Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite (SGSS) 1.0, gives read and write permissions to all use CVE-2006-12862.1Buffer overflow in the login dialog in dbisqlc.exe in SQLAnywhere for Symantec Ghost 8.0 and 8.2, as used in Symantec Ghost Solutions Suite CVE-2006-12875.8Cross-site scripting (XSS) vulnerability in Invision Power Board (IPB) 2.0.4 and 2.1.4 before 20060130 allows remote attackers to steal cook CVE-2006-12887.5Multiple SQL injection vulnerabilities in Invision Power Board (IPB) 2.0.4 and 2.1.4 before 20060105 allow remote attackers to execute arbit CVE-2006-12897.5Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands vi CVE-2006-12904.3Multiple cross-site scripting (XSS) vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to inject arbitrary web CVE-2006-12917.5publish.ical.php in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier does not require authentication for write access to the calendars CVE-2006-12925.0Directory traversal vulnerability in Jim Hu and Chad Little PHP iCalendar 2.21 and earlier allows remote attackers to include and execute ar CVE-2006-12934.3Cross-site scripting (XSS) vulnerability in index.php in Contrexx CMS 1.0.8 and earlier allows remote attackers to inject arbitrary web scri