CVE-2006-2066

Multiple cross-site scripting (XSS) vulnerabilities pm_popup.php in MKPortal 1.1 Rc1 and earlier, as used with vBulletin 3.5.4 and earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) u1, (2) m1, (3) m2, (4) m3, (5) m4 parameters.

• CWE-79

• http://secunia.com/advisories/19786Vendor Advisory
• http://securityreason.com/securityalert/801
• http://securitytracker.com/id?1015977Exploit
• http://www.nukedx.com/?viewdoc=26Exploit, Vendor Advisory
• http://www.osvdb.org/24901
• http://www.securityfocus.com/archive/1/431759/100/0/threaded
• http://www.securityfocus.com/archive/1/447195/100/0/threaded
• http://www.securityfocus.com/archive/1/447303/100/0/threaded
• http://www.securityfocus.com/bid/17651
• http://www.securityfocus.com/bid/20232
• http://www.vupen.com/english/advisories/2006/1485Vendor Advisory
• http://secunia.com/advisories/19786Vendor Advisory
• http://securityreason.com/securityalert/801
• http://securitytracker.com/id?1015977Exploit
• http://www.nukedx.com/?viewdoc=26Exploit, Vendor Advisory
• http://www.osvdb.org/24901
• http://www.securityfocus.com/archive/1/431759/100/0/threaded
• http://www.securityfocus.com/archive/1/447195/100/0/threaded
• http://www.securityfocus.com/archive/1/447303/100/0/threaded
• http://www.securityfocus.com/bid/17651
• http://www.securityfocus.com/bid/20232
• http://www.vupen.com/english/advisories/2006/1485Vendor Advisory

Published

Apr 27, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-2060Directory traversal vulnerability in action_admin/paysubscri…
• CVE-2006-2061SQL injection vulnerability in lib/func_taskmanager.php in I…
• CVE-2006-2062Multiple SQL injection vulnerabilities in Leadhound Full and…
• CVE-2006-2063Multiple cross-site scripting (XSS) vulnerabilities in Leadh…
• CVE-2006-2064Unspecified vulnerability in the libpkcs11 library in Sun So…
• CVE-2006-2065SQL injection vulnerability in save.php in PHPSurveyor 0.995…
• CVE-2006-2067SQL injection vulnerability in vb_board_functions.php in MKP…
• CVE-2006-2068Unspecified vulnerability in Hitachi JP1 products allow remo…
• CVE-2006-2069The recursor in PowerDNS before 3.0.1 allows remote attacker…
• CVE-2006-2070Cross-site scripting (XSS) vulnerability in member.php in De…
• CVE-2006-2071Linux kernel 2.4.x and 2.6.x up to 2.6.16 allows local users…
• CVE-2006-2072Multiple unspecified vulnerabilities in DeleGate 9.x before …