CVE-2006-6421

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 15.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-12-10 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in the private message box implementation (privmsg.php) in phpBB 2.0.x allows remote authenticated users to inject arbitrary web script or HTML via the "Message body" field in a message to a non-existent user.

Affected products

Phpbb Group Phpbb: 2.0, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4 (+26)

References

http://secunia.com/advisories/23283
http://securityreason.com/securityalert/2005
http://www.phpbb.com/phpBB/viewtopic.php?f=14&t=489624
http://www.securityfocus.com/archive/1/453774/100/0/threaded
http://www.securityfocus.com/archive/1/456579/100/0/threaded
http://www.securityfocus.com/archive/1/456728/100/100/threaded
http://www.securityfocus.com/archive/1/456784/100/100/threaded
http://www.securityfocus.com/bid/21806
http://www.securityfocus.com/bid/22001
https://exchange.xforce.ibmcloud.com/vulnerabilities/30776
http://secunia.com/advisories/23283
http://securityreason.com/securityalert/2005

Get alerted when CVE-2006-6421 or the next vulnerability affects your stack