Read the docs
TI-2006-02455 Aliases CVE-2006-2524GHSA-p4g9-3ph6-p8j6

Cross-site scripting (XSS) vulnerability in UseBB 1.0 RC1 and earlier allows remote…

Priority LOW 33Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Cross-site scripting (XSS) vulnerability in UseBB 1.0 RC1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when processing the user date format.

Why it matters now

EPSS 0.01441 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:usebb:usebb:1.0_rc1:*:*:*:*:*:*:*1.0_rc1VulnerableUseBB
  • cpe:2.3:a:usebb:usebb:1.0_rc1:*:*:*:*:*:*:* Versions 1.0_rc1 Vulnerable ·UseBB

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-2524
  2. 2026-10-03 Alias added: GHSA-p4g9-3ph6-p8j6

References

Patch 2

Other 2

  • TI-2020-06510 panel_login.php in UseBB 1.0.12 allows type juggling for login bypass because != is used… CVSS 3.1CRITICAL 9.8
  • TI-2007-03840 Multiple cross-site scripting (XSS) vulnerabilities in UseBB 1.0.7, and possibly other… CVSS 2.0HIGH 9.3
  • TI-2011-03186 Cross-Site Request Forgery (CSRF) vulnerability exists in panel.php in UseBB before 1.0.12. CVSS 3.1HIGH 8.8
  • TI-2011-03185 A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12. CVSS 3.1HIGH 7.2
  • TI-2005-02309 SQL injection vulnerability in UseBB 0.5.1 and earlier, when magic_quotes_gpc is… CVSS 2.0HIGH 7.5
  • TI-2006-02456 SQL injection vulnerability in UseBB 1.0 RC1 and earlier allows remote attackers to… CVSS 2.0MEDIUM 6.4
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences