← Vulnerability feed

Vulnerability record · CVE-2006-4706 · published 12 September 2006

CVE-2006-4706: Mybulletinboard vulnerability

Mybulletinboard · Mybulletinboard

Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via a url BBCode tag that contains a javascript URI with an SGML numeric character reference and an embedded space, as demonstrated using "java& #115;cript," a different vulnerability than CVE-2006-3761.

6.8 CVSS 2.0 Medium EPSS 2.5% · top 15.9%
6.8CVSS 2.0 base score
2.5%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.1.7 allows remote attackers to inject arbitrary web script or HTML via a url BBCode tag that contains a javascript URI with an SGML numeric character reference and an embedded space, as demonstrated using "java& #115;cript," a different vulnerability than CVE-2006-3761.

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://myimei.com/security/2006-08-15/mybb-117-htmlspeacialchar_uni-fixjavascript-functions_postphp-urlxss-attack.html ExploitPatch
http://secunia.com/advisories/21697
http://securityreason.com/securityalert/1541
http://www.mybboard.com/archive.php?nid=18 Patch
http://www.securityfocus.com/archive/1/444807/100/100/threaded
http://www.vupen.com/english/advisories/2006/3418
http://myimei.com/security/2006-08-15/mybb-117-htmlspeacialchar_uni-fixjavascript-functions_postphp-urlxss-attack.html ExploitPatch
http://secunia.com/advisories/21697
http://securityreason.com/securityalert/1541
http://www.mybboard.com/archive.php?nid=18 Patch
http://www.securityfocus.com/archive/1/444807/100/100/threaded
http://www.vupen.com/english/advisories/2006/3418

Track CVE-2006-4706 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2005-4200Mybulletinboard vulnerabilityMultiple unspecified vulnerabilities in MyBulletinBoard (MyBB) before 1.0 have unknown impact and attack vectors, a different set of vulnerabilities …EPSS 2.2%7.5CVE-2009-2230Mybulletinboard sql injection vulnerabilitySQL injection vulnerability in inc/datahandlers/user.php in MyBB (aka MyBulletinBoard) before 1.4.7 allows remote authenticated users to execute arbi…EPSS 1.2%7.5CVE-2008-0382Mybulletinboard code injection vulnerabilityMultiple eval injection vulnerabilities in MyBB 1.2.10 and earlier allow remote attackers to execute arbitrary code via the sortby parameter to (1) f…EPSS 42%7.5CVE-2007-2211Mybulletinboard vulnerabilitySQL injection vulnerability in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allows remote attackers to execute arbitrary SQL commands…EPSS 1.1%7.5CVE-2007-1963Mybb vulnerabilitySQL injection vulnerability in the create_session function in class_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and earlier allows remote attacke…EPSS 1.3%7.5CVE-2006-3775Mybulletinboard sql injection vulnerabilitySQL injection vulnerability in the init function in class_session.php in MyBB (aka MyBulletinBoard) 1.1.5 allows remote attackers to execute arbitrar…EPSS 2.5%7.5CVE-2006-3760Mybulletinboard vulnerabilityMultiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) 1.1.4 allow remote attackers to execute arbitrary SQL commands via unspecified v…EPSS 1.2%7.5CVE-2006-3758Mybulletinboard vulnerabilityinc/init.php in Archive Mode (Light) in MyBB (aka MyBulletinBoard) 1.1.4 calls the extract function with EXTR_OVERWRITE on HTTP POST and GET variable…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2006-4706), CISA KEV, FIRST EPSS (scores of 2026-10-14). This page is refreshed as NVD updates the record.