CVE-2006-0407
Summary
| CVE | CVE-2006-0407 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2006-01-25 02:03:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | Cross-site scripting (XSS) vulnerability in post.php in AZ Bulletin Board (AZbb) 1.1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) nickname parameter and (2) an iframe tag in the topic parameter. NOTE: the original disclosure specified the name parameter, but a correction was later provided. NOTE: followup posts have both disputed and confirmed the original claim. |
Risk And Classification
Primary CVSS: v2.0 4.3 from [email protected]
AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 0.013390000 probability, percentile 0.800330000 (date 2026-04-16)
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Azbb | Az Bulletin Board | 1.0.0 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.0.0rc1 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.0.0rc2 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.0.1 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.0.10 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.0.11 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.0.12 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.0.2 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.0.3 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.0.4 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.0.5 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.0.6 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.0.7 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.0.8 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.0.9 | All | All | All |
| Application | Azbb | Az Bulletin Board | 1.1.00 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| KAPDA :: Azbb v1.1.00 Cross_Site_Scripting | af854a3a-2127-422b-91ae-364da2661108 | kapda.ir | Exploit, Vendor Advisory |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Secunia - Advisories - AZ Bulletin Board Cross-Site Scripting Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| AZ Bulletin Board Post.PHP HTML Injection Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Exploit |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.