6.8

CVE-2006-2815

Multiple cross-site scripting (XSS) vulnerabilities in Two Shoes M-Factory (TSMF) SimpleBoard 1.1.0 Stable (aka com_simpleboard), as used in Mambo and Joomla!, allow remote attackers to inject arbitrary web script or HTML via (1) the Name field in "post ne topic" in the Frontend, (2) the Title (aka Community-Title) field in Simpleboard Configuration in the Backend Admin Panel, and the (3) Name (aka Forum-Title) and (4) Name (aka Category-Title) fields in Simpleboard Administration in the Backend Admin Panel.  NOTE: some sources have stated that the sb_authorname parameter is affected, but it is unclear which field is related to it.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Two Shoes Mambo Factory ≫ Simpleboard Version1.1.0_stable
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.46% 0.702
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046484.html
http://secunia.com/advisories/20409
Vendor Advisory
http://securityreason.com/securityalert/1030
http://www.securityfocus.com/archive/1/435615/100/0/threaded
http://www.securityfocus.com/bid/18251
http://www.vupen.com/english/advisories/2006/2111
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27021