Read the docs
TI-2006-00714 Aliases CVE-2006-0735GHSA-p47h-9f76-4343

Cross-site scripting (XSS) vulnerability in BBcode.pm in M.

Priority LOW 25Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Cross-site scripting (XSS) vulnerability in BBcode.pm in M. Blom HTML::BBCode 1.04 and earlier, as used in products such as My Blog before 1.65, allows remote attackers to inject arbitrary Javascript via a javascript URI in an (1) img or (2) url BBcode tag.

Why it matters now

EPSS 0.02894 87th percentileScored 2026-11-07
Public exploit Yes 3 exploit referencesTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:fuzzymonkey:my_blog:1.0:*:*:*:*:*:*:*1.0VulnerableFuzzymonkey
cpe:2.3:a:fuzzymonkey:my_blog:1.2:*:*:*:*:*:*:*1.2VulnerableFuzzymonkey
cpe:2.3:a:fuzzymonkey:my_blog:1.3:*:*:*:*:*:*:*1.3VulnerableFuzzymonkey
cpe:2.3:a:fuzzymonkey:my_blog:1.4:*:*:*:*:*:*:*1.4VulnerableFuzzymonkey
cpe:2.3:a:fuzzymonkey:my_blog:1.5:*:*:*:*:*:*:*1.5VulnerableFuzzymonkey
cpe:2.3:a:fuzzymonkey:my_blog:1.6:*:*:*:*:*:*:*1.6VulnerableFuzzymonkey
cpe:2.3:a:fuzzymonkey:my_blog:1.21:*:*:*:*:*:*:*1.21VulnerableFuzzymonkey
cpe:2.3:a:fuzzymonkey:my_blog:1.22:*:*:*:*:*:*:*1.22VulnerableFuzzymonkey
cpe:2.3:a:fuzzymonkey:my_blog:1.23:*:*:*:*:*:*:*1.23VulnerableFuzzymonkey
cpe:2.3:a:fuzzymonkey:my_blog:1.31:*:*:*:*:*:*:*1.31VulnerableFuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.21:*:*:*:*:*:*:* Versions 1.21 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.22:*:*:*:*:*:*:* Versions 1.22 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.23:*:*:*:*:*:*:* Versions 1.23 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.31:*:*:*:*:*:*:* Versions 1.31 Vulnerable ·Fuzzymonkey
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:fuzzymonkey:my_blog:1.51:*:*:*:*:*:*:*1.51VulnerableFuzzymonkey
cpe:2.3:a:fuzzymonkey:my_blog:1.52:*:*:*:*:*:*:*1.52VulnerableFuzzymonkey
cpe:2.3:a:fuzzymonkey:my_blog:1.61:*:*:*:*:*:*:*1.61VulnerableFuzzymonkey
cpe:2.3:a:fuzzymonkey:my_blog:1.62:*:*:*:*:*:*:*1.62VulnerableFuzzymonkey
cpe:2.3:a:fuzzymonkey:my_blog:1.63:*:*:*:*:*:*:*1.63VulnerableFuzzymonkey
cpe:2.3:a:fuzzymonkey:my_blog:1.64:*:*:*:*:*:*:*1.64VulnerableFuzzymonkey
cpe:2.3:a:m_blom:html-bbcode:1.03:*:*:*:*:*:*:*1.03VulnerableM Blom
cpe:2.3:a:m_blom:html-bbcode:1.04:*:*:*:*:*:*:*1.04VulnerableM Blom
  • cpe:2.3:a:fuzzymonkey:my_blog:1.51:*:*:*:*:*:*:* Versions 1.51 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.52:*:*:*:*:*:*:* Versions 1.52 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.61:*:*:*:*:*:*:* Versions 1.61 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.62:*:*:*:*:*:*:* Versions 1.62 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.63:*:*:*:*:*:*:* Versions 1.63 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:fuzzymonkey:my_blog:1.64:*:*:*:*:*:*:* Versions 1.64 Vulnerable ·Fuzzymonkey
  • cpe:2.3:a:m_blom:html-bbcode:1.03:*:*:*:*:*:*:* Versions 1.03 Vulnerable ·M Blom
  • cpe:2.3:a:m_blom:html-bbcode:1.04:*:*:*:*:*:*:* Versions 1.04 Vulnerable ·M Blom

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-0735
  2. 2026-10-03 Alias added: GHSA-p47h-9f76-4343

References

Exploit 3

Patch 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences