Skip to content
Fencer Vulns
medium 4.3

CVE-2006-1205 json

Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers to inject arbitrar…

published 2006-03-14 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-1209

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 87%
public exploits
10
Exploit-DB

Summary

Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) confirmredirect and (2) post_id parameters in (a) delcomment.php, as reachable when mode=delcom from index.php; and the (3) del and (4) message parameters in (b) upload.php, the (5) errormsg parameter in (c) addcat.php, (d) edituser.php, (e) adduser.php, and (f) editcat.php, the (6) trackback_url parameter in (g) add.php, (7) id parameter in (h) deluser.php, (8) cat_id parameter in (i) delcat.php, and (9) post_id parameter in (j) del.php, as reachable from admin.php.

Timeline

  1. First public exploit (EDB-27389)
  2. Published

Exploit prediction

2.92% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-27389 MyBloggie 2.1.2/2.1.3 - 'del.php' Cross-Site Scripting webapps, 2006-03-09
  • EDB-27388 MyBloggie 2.1.2/2.1.3 - 'delcat.php' Cross-Site Scripting webapps, 2006-03-09
  • EDB-27387 MyBloggie 2.1.2/2.1.3 - 'trackback_url' Cross-Site Scripting webapps, 2006-03-09
  • EDB-27386 MyBloggie 2.1.2/2.1.3 - 'editcat.php' Cross-Site Scripting webapps, 2006-03-09
  • EDB-27385 MyBloggie 2.1.2/2.1.3 - 'adduser.php' Cross-Site Scripting webapps, 2006-03-09
  • EDB-27384 MyBloggie 2.1.2/2.1.3 - 'edituser.php' Cross-Site Scripting webapps, 2006-03-09
  • EDB-27383 MyBloggie 2.1.2/2.1.3 - 'addcat.php' Cross-Site Scripting webapps, 2006-03-09
  • EDB-27382 MyBloggie 2.1.2/2.1.3 - 'deluser.php' Cross-Site Scripting webapps, 2006-03-09
  • EDB-27381 MyBloggie 2.1.2/2.1.3 - 'delcomment.php' Cross-Site Scripting webapps, 2006-03-09
  • EDB-27380 MyBloggie 2.1.2/2.1.3 - 'upload.php' Cross-Site Scripting webapps, 2006-03-09
  • securityfocus.com http://www.securityfocus.com/bid/17048 referenced PoC, tagged "exploit" by a source, unverified
  • seclab.tuwien.ac.at http://www.seclab.tuwien.ac.at/advisories/TUVSA-0603-002.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.