Read the docs
TI-2006-00393 Aliases CVE-2006-0407GHSA-g3cc-rr5v-966w

Cross-site scripting (XSS) vulnerability in post.php in AZ Bulletin Board (AZbb) 1.1.00…

Priority LOW 25Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Cross-site scripting (XSS) vulnerability in post.php in AZ Bulletin Board (AZbb) 1.1.00 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) nickname parameter and (2) an iframe tag in the topic parameter. NOTE: the original disclosure specified the name parameter, but a correction was later provided. NOTE: followup posts have both disputed and confirmed the original claim.

Why it matters now

EPSS 0.0262 85th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:azbb:az_bulletin_board:1.0.0:*:*:*:*:*:*:*1.0.0VulnerableAzbb
cpe:2.3:a:azbb:az_bulletin_board:1.0.0rc1:*:*:*:*:*:*:*1.0.0rc1VulnerableAzbb
cpe:2.3:a:azbb:az_bulletin_board:1.0.0rc2:*:*:*:*:*:*:*1.0.0rc2VulnerableAzbb
cpe:2.3:a:azbb:az_bulletin_board:1.0.1:*:*:*:*:*:*:*1.0.1VulnerableAzbb
cpe:2.3:a:azbb:az_bulletin_board:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableAzbb
cpe:2.3:a:azbb:az_bulletin_board:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableAzbb
cpe:2.3:a:azbb:az_bulletin_board:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableAzbb
cpe:2.3:a:azbb:az_bulletin_board:1.0.5:*:*:*:*:*:*:*1.0.5VulnerableAzbb
cpe:2.3:a:azbb:az_bulletin_board:1.0.6:*:*:*:*:*:*:*1.0.6VulnerableAzbb
cpe:2.3:a:azbb:az_bulletin_board:1.0.7:*:*:*:*:*:*:*1.0.7VulnerableAzbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Azbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.0rc1:*:*:*:*:*:*:* Versions 1.0.0rc1 Vulnerable ·Azbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.0rc2:*:*:*:*:*:*:* Versions 1.0.0rc2 Vulnerable ·Azbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Azbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Azbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·Azbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Azbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.5:*:*:*:*:*:*:* Versions 1.0.5 Vulnerable ·Azbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.6:*:*:*:*:*:*:* Versions 1.0.6 Vulnerable ·Azbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.7:*:*:*:*:*:*:* Versions 1.0.7 Vulnerable ·Azbb
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:azbb:az_bulletin_board:1.0.8:*:*:*:*:*:*:*1.0.8VulnerableAzbb
cpe:2.3:a:azbb:az_bulletin_board:1.0.9:*:*:*:*:*:*:*1.0.9VulnerableAzbb
cpe:2.3:a:azbb:az_bulletin_board:1.0.10:*:*:*:*:*:*:*1.0.10VulnerableAzbb
cpe:2.3:a:azbb:az_bulletin_board:1.0.11:*:*:*:*:*:*:*1.0.11VulnerableAzbb
cpe:2.3:a:azbb:az_bulletin_board:1.0.12:*:*:*:*:*:*:*1.0.12VulnerableAzbb
cpe:2.3:a:azbb:az_bulletin_board:1.1.00:*:*:*:*:*:*:*1.1.00VulnerableAzbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.8:*:*:*:*:*:*:* Versions 1.0.8 Vulnerable ·Azbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.9:*:*:*:*:*:*:* Versions 1.0.9 Vulnerable ·Azbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.10:*:*:*:*:*:*:* Versions 1.0.10 Vulnerable ·Azbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.11:*:*:*:*:*:*:* Versions 1.0.11 Vulnerable ·Azbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.0.12:*:*:*:*:*:*:* Versions 1.0.12 Vulnerable ·Azbb
  • cpe:2.3:a:azbb:az_bulletin_board:1.1.00:*:*:*:*:*:*:* Versions 1.1.00 Vulnerable ·Azbb

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-0407
  2. 2026-10-03 Alias added: GHSA-g3cc-rr5v-966w

References

Exploit 1

Other 1

  • TI-2005-01138 PHP remote file inclusion vulnerability in main_index.php in AZ Bulletin Board (AZbb)… CVSS 2.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences