Unscored CVE-2006-1898 EUVD-2006-1898GHSA-cw4v-3f8w-3q3q

Multiple cross-site scripting (XSS) vulnerabilities in Ralph Capper Tiny PHP Forum (TPF) 3.6 allow remote attackers to inject arbitrary web…

Published Apr 20, 2006 · Updated Aug 7, 2024 · Assigned by mitre

Description

Multiple cross-site scripting (XSS) vulnerabilities in Ralph Capper Tiny PHP Forum (TPF) 3.6 allow remote attackers to inject arbitrary web script or HTML via (1) the uname parameter in a view action in profile.php and (2) a login name. NOTE: the "Access to hash password" issue is already covered by CVE-2006-0103.

References

tinyphpforum-profile-error-xss(25856) vdb-entry
728 third-party-advisory
17553 vdb-entry
773 third-party-advisory
20060417 Tiny PHP forum - vulns mailing-list