low2.6Public exploit code
CVE-2006-0927
Multiple cross-site scripting (XSS) vulnerabilities in the JGS-XA JGS-Gallery Addon 4.0.0 and earlier for Woltlab Burning Board (wBB) 2.x allow remote attacker…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- JGS-Gallery 4.0 - 'Board jgs_galerie_scroll.php?userid' Cross-Site Scripting2006-02-23 · webapps · php · Verified
- JGS-Gallery 4.0 - 'jgs_galerie_slideshow.php' Multiple Cross-Site Scripting Vulnerabilities2006-02-23 · webapps · php · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in the JGS-XA JGS-Gallery Addon 4.0.0 and earlier for Woltlab Burning Board (wBB) 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) userid parameter in (a) jgs_galerie_slideshow.php and (b) jgs_galerie_scroll.php, and the (2) katid parameter in (c) jgs_galerie_slideshow.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jgs-Xa | Jgs-Gallery Addon | Version 4.0 |
| Woltlab | Burning Board | Versions 2.0, 2.0.3, 2.1.5, 2.2.1, 2.2.2, 2.2.3 |
References
- NVD record
- CVE.org record
- http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0615.html
- http://www.nukedx.com/?viewdoc=11
- http://www.securityfocus.com/archive/1/425981/100/0/threaded
- http://www.securityfocus.com/bid/16810
- http://www.securityfocus.com/bid/16843
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24888
- http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0615.html
- http://www.nukedx.com/?viewdoc=11
- http://www.securityfocus.com/archive/1/425981/100/0/threaded
- http://www.securityfocus.com/bid/16810
- http://www.securityfocus.com/bid/16843
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24888