CVE-2006-4881

Multiple cross-site scripting (XSS) vulnerabilities in David Bennett PHP-Post (PHPp) 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the replyuser parameter in (a) pm.php; (2) the txt_jumpto parameter in (b) dropdown.php; the (3) txt_error and (4) txt_templatenotexist parameters in (c) template.php; the (5) split parameter in certain files, as demonstrated by (d) editprofile.php, (e) search.php, (f) index.php, and (g) pm.php; and the (6) txt_login parameter in (h) loginline.php; and allow remote authenticated users to inject arbitrary web script or HTML via the (7) txt_logout parameter in (i) loginline.php.

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

4.82% chance of exploitation in the next 30 days, 91th percentile

Published

2006-09-19

Updated

2024-08-07

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/28592

References

• CVE Record
• NVD entry

Related

• CVE-2006-4878
• CVE-2006-4882
• CVE-2006-4877
• CVE-2006-4884
• CVE-2006-4876
• CVE-2006-4885