CVE-2006-0407

Cross-site scripting (XSS) vulnerability in post.php in AZ Bulletin Board (AZbb) 1.1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) nickname parameter and (2) an iframe tag in the topic parameter. NOTE: the original disclosure specified the name parameter, but a correction was later provided. NOTE: followup posts have both disputed and confirmed the original claim.

• http://kapda.ir/advisory-236.htmlExploit, Vendor Advisory
• http://secunia.com/advisories/18565Vendor Advisory
• http://www.securityfocus.com/archive/1/423353/100/0/threaded
• http://www.securityfocus.com/archive/1/423363/100/0/threaded
• http://www.securityfocus.com/archive/1/427076/100/0/threaded
• http://www.securityfocus.com/archive/1/427076/30/6510/threaded
• http://www.securityfocus.com/archive/1/427194/100/0/threaded
• http://www.securityfocus.com/bid/16351Exploit
• http://www.vupen.com/english/advisories/2006/0298
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24274
• http://kapda.ir/advisory-236.htmlExploit, Vendor Advisory
• http://secunia.com/advisories/18565Vendor Advisory
• http://www.securityfocus.com/archive/1/423353/100/0/threaded
• http://www.securityfocus.com/archive/1/423363/100/0/threaded
• http://www.securityfocus.com/archive/1/427076/100/0/threaded
• http://www.securityfocus.com/archive/1/427076/30/6510/threaded
• http://www.securityfocus.com/archive/1/427194/100/0/threaded
• http://www.securityfocus.com/bid/16351Exploit
• http://www.vupen.com/english/advisories/2006/0298
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24274

Published

Jan 25, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-0401Unspecified vulnerability in Mac OS X before 10.4.6, when ru…
• CVE-2006-0402SQL injection vulnerability in Zoph before 0.5pre1 allows re…
• CVE-2006-0403Multiple SQL injection vulnerabilities in e-moBLOG 1.3 allow…
• CVE-2006-0404Note-A-Day Weblog 2.2 stores sensitive data under the web do…
• CVE-2006-0405The TIFFFetchShortPair function in tif_dirread.c in libtiff …
• CVE-2006-0406search.php in MyBB 1.0.2 allows remote attackers to obtain s…
• CVE-2006-0408rsh utility in Sun Grid Engine (SGE) before 6.0u7_1 allows l…
• CVE-2006-0409Cross-site scripting (XSS) vulnerability in index.php in Pix…
• CVE-2006-0410SQL injection vulnerability in ADOdb before 4.71, when using…
• CVE-2006-0411claro_init_local.inc.php in Claroline 1.7.2 uses guessable s…
• CVE-2006-0412SQL injection vulnerability in CyberShop allows remote attac…
• CVE-2006-0413Multiple SQL injection vulnerabilities in index.php in NewsP…