Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2006-6421 — Cross-site Scripting in Group Phpbb

3 documents3 sources
Severity
6.0MEDIUMNVD
EPSS
1.9%
top 16.52%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Phpbb Group Phpbb
Timeline
PublishedDec 10
Latest updateMay 1

Description

Cross-site scripting (XSS) vulnerability in the private message box implementation (privmsg.php) in phpBB 2.0.x allows remote authenticated users to inject arbitrary web script or HTML via the "Message body" field in a message to a non-existent user.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 6.8 | Impact: 6.4

Affected Packages1 packages

▶NVDphpbb_group/phpbb32 versions+31

🔴Vulnerability Details

1
GHSA
GHSA-72m2-fw2r-7r4h: Cross-site scripting (XSS) vulnerability in the private message box implementation (privmsg↗2022-05-01
▶

💥Exploits & PoCs

1
Exploit-DB
phpBB 2.0.21 - 'privmsg.php' HTML Injection↗2007-01-11
▶