Description
Cross-site scripting (XSS) vulnerability in private.php in MyBB (aka MyBulletinBoard) allows remote authenticated users to inject arbitrary web script or HTML via the Subject field, a different vector than CVE-2006-2949.
References
- mybb-subject-field-xss(31740) vdb-entry
- 32967 vdb-entry
- 22205 vdb-entry
- 23934 third-party-advisory
- 20070124 [Aria-Security Team] MyBB Cross-Site Scripting mailing-list
- 28837 third-party-advisory