CVE-2006-0735 Cross-site scripting (XSS) vulnerability in BBcode.pm in M. Blom HTML::BBCode 1.04 and earlier, as used in products such as My Blog before 1.65, allows remote attackers to inject arbitrary Javascript....
MediumCVSS 4.3
EPSS 2.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in BBcode.pm in M. Blom HTML::BBCode 1.04 and earlier, as used in products such as My Blog before 1.65, allows remote attackers to inject arbitrary Javascript via a javascript URI in an (1) img or (2) url BBcode tag.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fuzzymonkey my blog | = 1.0 | No fix listed |
| fuzzymonkey my blog | = 1.2 | No fix listed |
| fuzzymonkey my blog | = 1.3 | No fix listed |
| fuzzymonkey my blog | = 1.4 | No fix listed |
| fuzzymonkey my blog | = 1.5 | No fix listed |
| fuzzymonkey my blog | = 1.6 | No fix listed |
| fuzzymonkey my blog | = 1.21 | No fix listed |
| fuzzymonkey my blog | = 1.22 | No fix listed |
| fuzzymonkey my blog | = 1.23 | No fix listed |
| fuzzymonkey my blog | = 1.31 | No fix listed |
| fuzzymonkey my blog | = 1.51 | No fix listed |
| fuzzymonkey my blog | = 1.52 | No fix listed |
| fuzzymonkey my blog | = 1.61 | No fix listed |
| fuzzymonkey my blog | = 1.62 | No fix listed |
| fuzzymonkey my blog | = 1.63 | No fix listed |
| fuzzymonkey my blog | = 1.64 | No fix listed |
| m blom html-bbcode | = 1.03 | No fix listed |
| m blom html-bbcode | = 1.04 | No fix listed |
References
- evuln.com exploit patch vendor-advisory
- evuln.com exploit patch vendor-advisory
- fuzzymonkey.net patch
- menno.b10m.net
- menno.b10m.net
- 18905 patch third-party-advisory vendor-advisory
- 18925 third-party-advisory vendor-advisory
- www.evuln.com exploit patch vendor-advisory
- 20060215 [eVuln] My Blog BBCode XSS Vulnerabilities mailing-list
- 20060215 [eVuln] M. Blom HTML::BBCode perl module XSS Vulnerabilities mailing-list
- 16659 exploit patch vdb-entry
- ADV-2006-0614 vdb-entry
- ADV-2006-0642 vdb-entry
- myblog-bbcode-xss(24668) vdb-entry