CVE-2006-2815 json
Multiple cross-site scripting (XSS) vulnerabilities in Two Shoes M-Factory (TSMF) SimpleBoard 1.1.0 Stable (aka com_simpleboard), as used i…
published 2006-06-05 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-2812
- cvss
- 6.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.5%
- EPSS 1.5% chance of exploitation in 30 days, percentile 74%
- public exploits
- 0
- none known
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Two Shoes M-Factory (TSMF) SimpleBoard 1.1.0 Stable (aka com_simpleboard), as used in Mambo and Joomla!, allow remote attackers to inject arbitrary web script or HTML via (1) the Name field in "post ne topic" in the Frontend, (2) the Title (aka Community-Title) field in Simpleboard Configuration in the Backend Admin Panel, and the (3) Name (aka Forum-Title) and (4) Name (aka Category-Title) fields in Simpleboard Administration in the Backend Admin Panel. NOTE: some sources have stated that the sb_authorname parameter is affected, but it is unclear which field is related to it.
Exploit prediction
1.49% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
secunia.com
/advisories/20409
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2006/2111
vdb-entry, vendor-advisory
-
securityfocus.com
/archive/1/435615/100/0/threaded
mailing-list
-
lists.grok.org.uk
/pipermail/full-disclosure/2006-June/046484.html
mailing-list
-
exchange.xforce.ibmcloud.com
/vulnerabilities/27021
vdb-entry
-
securityreason.com
/securityalert/1030
third-party-advisory
-
securityfocus.com
/bid/18251
vdb-entry
Sources
- CVE List CVE-2006-2815
- NVD CVE-2006-2815
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.