CVE-2006-0927

Multiple cross-site scripting (XSS) vulnerabilities in the JGS-XA JGS-Gallery Addon 4.0.0 and earlier for Woltlab Burning Board (wBB) 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) userid parameter in (a) jgs_galerie_slideshow.php and (b) jgs_galerie_scroll.php, and the (2) katid parameter in (c) jgs_galerie_slideshow.php.

• http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0615.html
• http://www.nukedx.com/?viewdoc=11Exploit, Vendor Advisory
• http://www.securityfocus.com/archive/1/425981/100/0/threaded
• http://www.securityfocus.com/bid/16810Vendor Advisory
• http://www.securityfocus.com/bid/16843
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24888
• http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0615.html
• http://www.nukedx.com/?viewdoc=11Exploit, Vendor Advisory
• http://www.securityfocus.com/archive/1/425981/100/0/threaded
• http://www.securityfocus.com/bid/16810Vendor Advisory
• http://www.securityfocus.com/bid/16843
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24888

Published

Feb 28, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-0921Multiple directory traversal vulnerabilities in connector.ph…
• CVE-2006-0922CubeCart 3.0 through 3.6 does not properly check authorizati…
• CVE-2006-0923Multiple cross-site scripting (XSS) vulnerabilities in MyPHP…
• CVE-2006-0924Cross-site scripting (XSS) vulnerability in Brown Bear iCal …
• CVE-2006-0925Format string vulnerability in the IMAP4rev1 server in Alt-N…
• CVE-2006-0926Multiple directory traversal vulnerabilities in Allume Stuff…
• CVE-2006-0928The POP3 Server in ArGoSoft Mail Server Pro 1.8 allows remot…
• CVE-2006-0929Directory traversal vulnerability in the IMAP server in ArGo…
• CVE-2006-0930Directory traversal vulnerability in Webmail in ArGoSoft Mai…
• CVE-2006-0931Directory traversal vulnerability in PEAR::Archive_Tar 1.2, …
• CVE-2006-0932Directory traversal vulnerability in zip.lib.php 0.1.1 in PE…
• CVE-2006-0933Cross-site scripting (XSS) vulnerability in PHPX 3.5.9 allow…