CVE-2006-2491

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-05-19 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in (1) index.php and (2) bmc/admin.php in BoastMachine (bMachine) 3.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly filtered when it is accessed using the $_SERVER["PHP_SELF"] variable.

Affected products

Boastmachine: through 3.1; 3.0
Kailash Nadh Boastmachine: 2.5, 2.7, 2.8, 2.9b

References

http://secunia.com/advisories/20149
http://securityreason.com/securityalert/725
http://securityreason.com/securityalert/927
http://www.osvdb.org/25617
http://www.osvdb.org/25618
http://www.securityfocus.com/archive/1/434294/100/0/threaded
http://www.securityfocus.com/bid/18012
http://www.vupen.com/english/advisories/2006/1853
https://exchange.xforce.ibmcloud.com/vulnerabilities/26518
http://secunia.com/advisories/20149
http://securityreason.com/securityalert/725
http://securityreason.com/securityalert/927

Get alerted when CVE-2006-2491 or the next vulnerability affects your stack