CVE-2006-2109
Last modified
CVE-2006-2109 is a vulnerability of currently unknown severity. Cross-site scripting (XSS) vulnerability in the parse_query_str function in include/print.php in JSBoard 2.0.10 and 2.0.11, and possibly other versions before 2.0.12, allows remote attackers to inject arbitrary web script or HTML via parameters that are set as global variables within the program, as demonstrated using the table parameter to login.php.. EPSS estimates a 2.29% chance of exploitation in the next 30 days.
Description
Cross-site scripting (XSS) vulnerability in the parse_query_str function in include/print.php in JSBoard 2.0.10 and 2.0.11, and possibly other versions before 2.0.12, allows remote attackers to inject arbitrary web script or HTML via parameters that are set as global variables within the program, as demonstrated using the table parameter to login.php.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jsboard | Jsboard | <= 2.0.11 |
| Jsboard | Jsboard | 2.0.7 |
| Jsboard | Jsboard | 2.0.8 |
| Jsboard | Jsboard | 2.0.9 |
| Jsboard | Jsboard | 2.0.10 |
References
- https://www.klink.name/security/aklink-sa-2006-001-jsboard-xss.txtExploit, Patch, Vendor Advisory
- https://www.klink.name/security/aklink-sa-2006-001-jsboard-xss.txtExploit, Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2006-2109?
How severe is CVE-2006-2109?
How do I fix CVE-2006-2109?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2006
- CVE-2006-2103SQL injection vulnerability in MyBB (MyBulletinBoard) 1.1.1 …
- CVE-2006-2104Multiple cross-site scripting (XSS) vulnerabilities in Kamga…
- CVE-2006-2105Directory traversal vulnerability in index.php in Jupiter CM…
- CVE-2006-2106Cross-site scripting (XSS) vulnerability in Edgewall Softwar…
- CVE-2006-2107Buffer overflow in BL4 SMTP Server 0.1.4 and earlier allows …
- CVE-2006-2108parser.exe in Océ (OCE) 3121/3122 Printer allows remote atta…
- CVE-2006-2110Virtual Private Server (Vserver) 2.0.x before 2.0.2-rc18 and…
- CVE-2006-2111A component in Microsoft Outlook Express 6 allows remote att…
- CVE-2006-2112Fuji Xerox Printing Systems (FXPS) print engine, as used in …
- CVE-2006-2113The embedded HTTP server in Fuji Xerox Printing Systems (FXP…
- CVE-2006-2114Buffer overflow in SWS web Server 0.1.7 allows remote attack…
- CVE-2006-2115Format string vulnerability in SWS web Server 0.1.7 allows r…
Are you affected by CVE-2006-2109?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST