CVE-2006-6421

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 15%

from disclosure to weapon32 days

Published on NVDDec 10

1st PoC+32d

exploitation probability

15%top 3% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

Cross-site scripting (XSS) vulnerability in the private message box implementation (privmsg.php) in phpBB 2.0.x allows remote authenticated users to inject arbitrary web script or HTML via the "Message body" field in a message to a non-existent user.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/29442

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://secunia.com/advisories/23283 http://securityreason.com/securityalert/2005 https://exchange.xforce.ibmcloud.com/vulnerabilities/30776 http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=489624 http://www.securityfocus.com/archive/1/453774/100/0/threaded http://www.securityfocus.com/archive/1/456579/100/0/threaded http://www.securityfocus.com/archive/1/456728/100/100/threaded http://www.securityfocus.com/archive/1/456784/100/100/threaded http://www.securityfocus.com/bid/21806 http://www.securityfocus.com/bid/22001