Description
Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.10 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode email tag, as demonstrated using the onmousemove event.
References
- 17368 vdb-entry
- 19516 third-party-advisory
- mybb-email-img-bbcode-xss(25615) vdb-entry
- 24375 vdb-entry
- ADV-2006-1216 vdb-entry
- 20060402 MyBB 1.10 New CrossSiteScripting mailing-list