Vulnerabilities > CVE-2006-1716 - HTML Injection vulnerability in Mybulletinboard 1.10

047910
CVSS 5.1 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
high complexity
mybulletinboard
NVD
Published: 2006-04-11
Updated: 2018-10-18

Summary

Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.10 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode img tag. NOTE: the email vector is already covered by CVE-2006-1625, although it might stem from the same core issue. Successful exploitation requires that unauthenticated users are allowed to post new threads (not the default setting).

Vulnerable Configurations

Part Description Count
Application
Mybulletinboard
1

References