CVE-2006-6421 EXPLOIT
6.0
MEDIUM · CVSS 2.0 · EPSS 15.6% (pctl 97)
Patch early
A public exploit exists.
Description
Cross-site scripting (XSS) vulnerability in the private message box implementation (privmsg.php) in phpBB 2.0.x allows remote authenticated users to inject arbitrary web script or HTML via the "Message body" field in a message to a non-existent user.
Scoring
| CVSS | 6.0 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:S/C:P/I:P/A:P |
| EPSS | 15.56% — more likely to be exploited than 97% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2006-12-10 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| phpbb group | phpbb |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | phpBB 2.0.21 - 'privmsg.php' HTML Injection | 2007-01-11 |
References
- http://secunia.com/advisories/23283
- http://securityreason.com/securityalert/2005
- http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=489624
- http://www.securityfocus.com/archive/1/453774/100/0/threaded
- http://www.securityfocus.com/archive/1/456579/100/0/threaded
- http://www.securityfocus.com/archive/1/456728/100/100/threaded
- http://www.securityfocus.com/archive/1/456784/100/100/threaded
- http://www.securityfocus.com/bid/21806
- http://www.securityfocus.com/bid/22001
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30776
- http://secunia.com/advisories/23283
- http://securityreason.com/securityalert/2005
- http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=489624
- http://www.securityfocus.com/archive/1/453774/100/0/threaded
- http://www.securityfocus.com/archive/1/456579/100/0/threaded
- http://www.securityfocus.com/archive/1/456728/100/100/threaded
- http://www.securityfocus.com/archive/1/456784/100/100/threaded
- http://www.securityfocus.com/bid/21806
- http://www.securityfocus.com/bid/22001
- https://exchange.xforce.ibmcloud.com/vulnerabilities/30776
→ the Explorer · watch your stack · NVD