CVE-2006-1205
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier...
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) confirmredirect and (2) post_id parameters in (a) delcomment.php, as reachable when mode=delcom from index.php; and the (3) del and (4) message parameters in (b) upload.php, the (5) errormsg parameter in (c) addcat.php, (d) edituser.php, (e) adduser.php, and (f) editcat.php, the (6) trackback_url parameter in (g) add.php, (7) id parameter in (h) deluser.php, (8) cat_id parameter in (i) delcat.php, and (9) post_id parameter in (j) del.php, as reachable from admin.php.
Exploit likelihood
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) confirmredirect and (2) post_id parameters in (a) delcomment.php, as reachable when mode=delcom from index.php; and the (3) del and (4) message parameters in (b) upload.php, the (5) errormsg parameter in (c) addcat.php, (d) edituser.php, (e) adduser.php, and (f) editcat.php, the (6) trackback_url parameter in (g) add.php, (7) id parameter in (h) deluser.php, (8) cat_id parameter in (i) delcat.php, and (9) post_id parameter in (j) del.php, as reachable from admin.php.
- Record
CVE-2006-1205- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) confirmredirect and (2) post_id parameters in (a) delcomment.php, as reachable when mode=delcom from index.php; and the (3) del and (4) message parameters in (b) upload.php, the (5) errormsg parameter in (c) addcat.php, (d) edituser.php, (e) adduser.php, and (f) editcat.php, the (6) trackback_url parameter in (g) add.php, (7) id parameter in (h) deluser.php, (8) cat_id parameter in (i) delcat.php, and (9) post_id parameter in (j) del.php, as reachable from admin.php.
- Record
CVE-2006-1205- Updated
- 2026-11-02
EUVDEUVD-2006-1209 No score
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) confirmredirect and (2) post_id parameters in (a) delcomment.php, as reachable when mode=delcom from index.php; and the (3) del and (4) message parameters in (b) upload.php, the (5) errormsg parameter in (c) addcat.php, (d) edituser.php, (e) adduser.php, and (f) editcat.php, the (6) trackback_url parameter in (g) add.php, (7) id parameter in (h) deluser.php, (8) cat_id parameter in (i) delcat.php, and (9) post_id parameter in (j) del.php, as reachable from admin.php.
- Record
EUVD-2006-1209- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7c9q-g65h-8hg7 No score
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier...
Multiple cross-site scripting (XSS) vulnerabilities in myWebland myBloggie 2.1.3 beta and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) confirmredirect and (2) post_id parameters in (a) delcomment.php, as reachable when mode=delcom from index.php; and the (3) del and (4) message parameters in (b) upload.php, the (5) errormsg parameter in (c) addcat.php, (d) edituser.php, (e) adduser.php, and (f) editcat.php, the (6) trackback_url parameter in (g) add.php, (7) id parameter in (h) deluser.php, (8) cat_id parameter in (i) delcat.php, and (9) post_id parameter in (j) del.php, as reachable from admin.php.
- Record
GHSA-7c9q-g65h-8hg7- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | MyBloggie 2.1.2/2.1.3 - 'upload.php' Cross-Site Scripting | 2006-03-09 |
| Exploit-DB | MyBloggie 2.1.2/2.1.3 - 'delcomment.php' Cross-Site Scripting | 2006-03-09 |
| Exploit-DB | MyBloggie 2.1.2/2.1.3 - 'deluser.php' Cross-Site Scripting | 2006-03-09 |
| Exploit-DB | MyBloggie 2.1.2/2.1.3 - 'addcat.php' Cross-Site Scripting | 2006-03-09 |
| Exploit-DB | MyBloggie 2.1.2/2.1.3 - 'edituser.php' Cross-Site Scripting | 2006-03-09 |
| Exploit-DB | MyBloggie 2.1.2/2.1.3 - 'adduser.php' Cross-Site Scripting | 2006-03-09 |
| Exploit-DB | MyBloggie 2.1.2/2.1.3 - 'editcat.php' Cross-Site Scripting | 2006-03-09 |
| Exploit-DB | MyBloggie 2.1.2/2.1.3 - 'trackback_url' Cross-Site Scripting | 2006-03-09 |
| Exploit-DB | MyBloggie 2.1.2/2.1.3 - 'delcat.php' Cross-Site Scripting | 2006-03-09 |
| Exploit-DB | MyBloggie 2.1.2/2.1.3 - 'del.php' Cross-Site Scripting | 2006-03-09 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-1205 is a medium vulnerability (CVSS 4.3) in Mywebland Mybloggie, published March 14, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.92%, the 87th percentile. No source names a fixed version.