CVE-2006-6375

Cross-site scripting (XSS) vulnerability in display.php in Simple Machines Forum (SMF) 1.1 Final and earlier allows remote attackers to inject arbitrary web script or HTML via the contents of a file that is uploaded with the image parameter set, which can be interpreted as script by Internet Explorer's automatic type detection.

• http://secunia.com/advisories/23175Patch, Vendor Advisory
• http://securityreason.com/securityalert/2001
• http://www.securityfocus.com/archive/1/453426/100/0/threaded
• http://www.securityfocus.com/bid/21431Vendor Advisory
• http://www.vupen.com/english/advisories/2006/4843
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30659
• http://secunia.com/advisories/23175Patch, Vendor Advisory
• http://securityreason.com/securityalert/2001
• http://www.securityfocus.com/archive/1/453426/100/0/threaded
• http://www.securityfocus.com/bid/21431Vendor Advisory
• http://www.vupen.com/english/advisories/2006/4843
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30659

Published

Dec 7, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-6369SQL injection vulnerability in lib/entry_reply_entry.php in …
• CVE-2006-6370SQL injection vulnerability in forum/modules/gallery/post.ph…
• CVE-2006-6371Cross-site scripting (XSS) vulnerability in pbguestbook.php …
• CVE-2006-6372Multiple cross-site scripting (XSS) vulnerabilities in pbgue…
• CVE-2006-6373PhpMyAdmin 2.7.0-pl2 allows remote attackers to obtain sensi…
• CVE-2006-6374Multiple CRLF injection vulnerabilities in PhpMyAdmin 2.7.0-…
• CVE-2006-6376Multiple directory traversal vulnerabilities in fm.php in Si…
• CVE-2006-6377Uploadscript 1.2 and earlier stores sensitive data under the…
• CVE-2006-6378BTSaveMySql 1.2 stores sensitive data under the web root wit…
• CVE-2006-6379Buffer overflow in the BrightStor Backup Discovery Service i…
• CVE-2006-6380Cross-site scripting (XSS) vulnerability in index.asp in Ult…
• CVE-2006-6381Directory traversal vulnerability in getfile.asp in Ultimate…