CVE-2006-0470

Cross-site scripting (XSS) vulnerability in search.php in MyBulletinBoard (MyBB) 1.02 allows remote attackers to inject arbitrary web script or HTML via the (1) sortby and (2) sortordr parameters, which are not properly handled in a redirection.

• http://community.mybboard.net/attachment.php?aid=2181
• http://community.mybboard.net/showthread.php?tid=6418
• http://seclists.org/lists/bugtraq/2006/Jan/0414.htmlExploit, Vendor Advisory
• http://secunia.com/advisories/18617Vendor Advisory
• http://securityreason.com/securityalert/374
• http://www.osvdb.org/22750
• http://www.securityfocus.com/bid/16387
• http://www.vupen.com/english/advisories/2006/0350
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24466
• http://community.mybboard.net/attachment.php?aid=2181
• http://community.mybboard.net/showthread.php?tid=6418
• http://seclists.org/lists/bugtraq/2006/Jan/0414.htmlExploit, Vendor Advisory
• http://secunia.com/advisories/18617Vendor Advisory
• http://securityreason.com/securityalert/374
• http://www.osvdb.org/22750
• http://www.securityfocus.com/bid/16387
• http://www.vupen.com/english/advisories/2006/0350
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24466

Published

Jan 31, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-0464Multiple SQL injection vulnerabilities in index.php in IdeoC…
• CVE-2006-0465Cross-site scripting (XSS) vulnerability in risultati_ricerc…
• CVE-2006-0466Cross-site scripting (XSS) vulnerability in search.asp in Go…
• CVE-2006-0467Unspecified vulnerability in Pioneers (formerly gnocatan) be…
• CVE-2006-0468CommuniGate Pro Core Server before 5.0.7 allows remote attac…
• CVE-2006-0469Cross-site scripting (XSS) vulnerability in UebiMiau 2.7.9, …
• CVE-2006-0471Cross-site scripting (XSS) vulnerability in the bbcode funct…
• CVE-2006-0472Cross-site scripting (XSS) vulnerability in guestbook.php in…
• CVE-2006-0473Cross-site scripting (XSS) vulnerability in the bbcode funct…
• CVE-2006-0474Multiple integer overflows in Shareaza 2.2.1.0 allow remote …
• CVE-2006-0475PHP-Ping 1.3 does not properly validate ping counts, which a…
• CVE-2006-0476Buffer overflow in Nullsoft Winamp 5.12 allows remote attack…