CVE-2006-1106

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-03-09 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in Pixelpost 1.5 beta 1 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) message, (2) name, (3) url, and (4) email parameters when commenting on a post. NOTE: the vendor has disputed some issues from the original disclosure, but due to the vagueness of the dispute, it is not clear whether the vendor is disputing this particular issue.

Affected products

Pixelpost.org Pixelpost: 1.4.3, 1.5_beta1

References

http://forum.pixelpost.org/showthread.php?t=3535
http://www.neosecurityteam.net/index.php?action=advisories&id=19
http://www.securityfocus.com/archive/1/426764/100/0/threaded
http://www.securityfocus.com/bid/16964
http://www.vupen.com/english/advisories/2006/0823
https://exchange.xforce.ibmcloud.com/vulnerabilities/25047
http://forum.pixelpost.org/showthread.php?t=3535
http://www.neosecurityteam.net/index.php?action=advisories&id=19
http://www.securityfocus.com/archive/1/426764/100/0/threaded
http://www.securityfocus.com/bid/16964
http://www.vupen.com/english/advisories/2006/0823
https://exchange.xforce.ibmcloud.com/vulnerabilities/25047

Get alerted when CVE-2006-1106 or the next vulnerability affects your stack