{"api_version":"1","generated_at":"2026-07-23T08:06:47+00:00","cve":"CVE-2005-3688","urls":{"html":"https://cve.report/CVE-2005-3688","api":"https://cve.report/api/cve/CVE-2005-3688.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2005-3688","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2005-3688"},"summary":{"title":"CVE-2005-3688","description":"Cross-site scripting (XSS) vulnerability in members.php in XMB 1.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the \"Your Current Mood\" field in the registration page.","state":"PUBLISHED","assigner":"mitre","published_at":"2005-11-19 01:03:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/archive/1/417078/30/0/threaded","name":"http://www.securityfocus.com/archive/1/417078/30/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/17642","name":"http://secunia.com/advisories/17642","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"XMB \"Your Current Mood\" Script Insertion Vulnerability - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://irannetjob.com/content/view/163/28/","name":"http://irannetjob.com/content/view/163/28/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","URL Repurposed"],"title":"irannetjob.com - XMB HTML Injection & Path Disclosure","mime":"text/xml","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2005/2488","name":"http://www.vupen.com/english/advisories/2005/2488","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail - OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://docs.xmbforum2.com/index.php?title=Security_Issue_History","name":"https://docs.xmbforum2.com/index.php?title=Security_Issue_History","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Issue History - XMBdocs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/15489","name":"http://www.securityfocus.com/bid/15489","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"XMB Forum Member.PHP HTML Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://securitytracker.com/id?1015237","name":"http://securitytracker.com/id?1015237","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - XMB Forum Input Validation Hole in 'Your Current Mood' Field in the 'member.php' Script Permits Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-3688","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-3688","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2005","cve_id":"3688","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xmb_forum","cpe5":"xmb","cpe6":"1.8_sp1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"3688","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xmb_forum","cpe5":"xmb","cpe6":"1.8_sp2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"3688","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xmb_forum","cpe5":"xmb","cpe6":"1.8_sp3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"3688","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xmb_forum","cpe5":"xmb","cpe6":"1.9.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"3688","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xmb_forum","cpe5":"xmb","cpe6":"1.9.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"3688","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xmb_forum","cpe5":"xmb","cpe6":"1.9_beta","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"3688","vulnerable":"1","versionEndIncluding":"1.9.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"xmb_forum","cpe5":"xmb","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[{"cvename":"CVE-2005-3688","organization":"XMB","lastmodified":"2021-04-23","contributor":"Robert Chapin","statementText":"This CVE is considered invalid because it duplicates CVE-2005-0885, \"XMB versions 1.9.8 and later were checked and are not vulnerable.\" Upgrades are available at https://www.xmbforum2.com/","cve_year":"2005","cve_id":"3688","crc32":"df673496"}],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T23:17:23.605Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"15489","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/15489"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://irannetjob.com/content/view/163/28/"},{"name":"20051117 [KAPDA::#13] - XMB HTML Injection & Path Disclosure.","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/417078/30/0/threaded"},{"name":"17642","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/17642"},{"name":"ADV-2005-2488","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2005/2488"},{"name":"1015237","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1015237"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://docs.xmbforum2.com/index.php?title=Security_Issue_History"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2005-11-18T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in members.php in XMB 1.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the \"Your Current Mood\" field in the registration page."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2021-04-29T14:36:40.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"15489","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/15489"},{"tags":["x_refsource_MISC"],"url":"http://irannetjob.com/content/view/163/28/"},{"name":"20051117 [KAPDA::#13] - XMB HTML Injection & Path Disclosure.","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/417078/30/0/threaded"},{"name":"17642","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/17642"},{"name":"ADV-2005-2488","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2005/2488"},{"name":"1015237","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1015237"},{"tags":["x_refsource_MISC"],"url":"https://docs.xmbforum2.com/index.php?title=Security_Issue_History"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2005-3688","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in members.php in XMB 1.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the \"Your Current Mood\" field in the registration page."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"15489","refsource":"BID","url":"http://www.securityfocus.com/bid/15489"},{"name":"http://irannetjob.com/content/view/163/28/","refsource":"MISC","url":"http://irannetjob.com/content/view/163/28/"},{"name":"20051117 [KAPDA::#13] - XMB HTML Injection & Path Disclosure.","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/417078/30/0/threaded"},{"name":"17642","refsource":"SECUNIA","url":"http://secunia.com/advisories/17642"},{"name":"ADV-2005-2488","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2005/2488"},{"name":"1015237","refsource":"SECTRACK","url":"http://securitytracker.com/id?1015237"},{"name":"https://docs.xmbforum2.com/index.php?title=Security_Issue_History","refsource":"MISC","url":"https://docs.xmbforum2.com/index.php?title=Security_Issue_History"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2005-3688","datePublished":"2005-11-19T01:00:00.000Z","dateReserved":"2005-11-19T00:00:00.000Z","dateUpdated":"2024-08-07T23:17:23.605Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2005-11-19 01:03:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:xmb_forum:xmb:*:*:*:*:*:*:*:*","versionEndIncluding":"1.9.3","matchCriteriaId":"9E1D3271-7AF8-4993-95A1-AA4A0323E31E"},{"vulnerable":true,"criteria":"cpe:2.3:a:xmb_forum:xmb:1.8_sp1:*:*:*:*:*:*:*","matchCriteriaId":"A1A6D868-8DB9-40AF-82C5-D9697876F91E"},{"vulnerable":true,"criteria":"cpe:2.3:a:xmb_forum:xmb:1.8_sp2:*:*:*:*:*:*:*","matchCriteriaId":"5016F4A0-C50A-4B27-B0E3-4FAA4D1645EF"},{"vulnerable":true,"criteria":"cpe:2.3:a:xmb_forum:xmb:1.8_sp3:*:*:*:*:*:*:*","matchCriteriaId":"DCB6F1E0-B54E-4D45-901C-9E2992C98BBF"},{"vulnerable":true,"criteria":"cpe:2.3:a:xmb_forum:xmb:1.9.1:*:*:*:*:*:*:*","matchCriteriaId":"6305AB1C-E801-4EF8-8783-01714E6F6D30"},{"vulnerable":true,"criteria":"cpe:2.3:a:xmb_forum:xmb:1.9.2:*:*:*:*:*:*:*","matchCriteriaId":"C7605AF8-2AF5-447D-8D63-32327899623D"},{"vulnerable":true,"criteria":"cpe:2.3:a:xmb_forum:xmb:1.9_beta:*:*:*:*:*:*:*","matchCriteriaId":"BC06BDA0-F6D1-4B0D-B807-40B5A3F36B52"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2005","CveId":"3688","Ordinal":"1","Title":"CVE-2005-3688","CVE":"CVE-2005-3688","Year":"2005"},"notes":[{"CveYear":"2005","CveId":"3688","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in members.php in XMB 1.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the \"Your Current Mood\" field in the registration page.","Type":"Description","Title":"CVE-2005-3688"},{"CveYear":"2005","CveId":"3688","Ordinal":"2","NoteData":"2005-11-18","Type":"Other","Title":"Published"},{"CveYear":"2005","CveId":"3688","Ordinal":"3","NoteData":"2021-04-29","Type":"Other","Title":"Modified"}]}}}