CVE-2006-0409

Cross-site scripting (XSS) vulnerability in index.php in Pixelpost Photoblog 1.4.3 allows remote attackers to inject arbitrary web script or HTML via the "Add Comment" field in a comment popup.

• http://evuln.com/vulns/45/summary.htmlExploit, Vendor Advisory
• http://secunia.com/advisories/18572Vendor Advisory
• http://securitytracker.com/id?1015529
• http://www.securityfocus.com/archive/1/423384/100/0/threaded
• http://www.securityfocus.com/bid/16362Exploit
• http://www.vupen.com/english/advisories/2006/0309
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24261
• http://evuln.com/vulns/45/summary.htmlExploit, Vendor Advisory
• http://secunia.com/advisories/18572Vendor Advisory
• http://securitytracker.com/id?1015529
• http://www.securityfocus.com/archive/1/423384/100/0/threaded
• http://www.securityfocus.com/bid/16362Exploit
• http://www.vupen.com/english/advisories/2006/0309
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24261

Published

Jan 25, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-0403Multiple SQL injection vulnerabilities in e-moBLOG 1.3 allow…
• CVE-2006-0404Note-A-Day Weblog 2.2 stores sensitive data under the web do…
• CVE-2006-0405The TIFFFetchShortPair function in tif_dirread.c in libtiff …
• CVE-2006-0406search.php in MyBB 1.0.2 allows remote attackers to obtain s…
• CVE-2006-0407Cross-site scripting (XSS) vulnerability in post.php in AZ B…
• CVE-2006-0408rsh utility in Sun Grid Engine (SGE) before 6.0u7_1 allows l…
• CVE-2006-0410SQL injection vulnerability in ADOdb before 4.71, when using…
• CVE-2006-0411claro_init_local.inc.php in Claroline 1.7.2 uses guessable s…
• CVE-2006-0412SQL injection vulnerability in CyberShop allows remote attac…
• CVE-2006-0413Multiple SQL injection vulnerabilities in index.php in NewsP…
• CVE-2006-0414Tor before 0.1.1.20 allows remote attackers to identify hidd…
• CVE-2006-0415Cross-site scripting (XSS) vulnerability in index.php in Sle…