Vulnerability Report

CVE-2006-1326

Title: Invision Power Services Invision Power Board Cross-Site Scripting (XSS)

XSS

Proof Of Concept

PoC Available for CVE-2006-1326

CWE Category NVD-CWE-noinfo
Published Date Mar 21, 2006
Modified Date Jun 16, 2026
Exploit Status Available
Score 4.3 CVSS v2.0
Exploit Probability (EPSS)
2.38%

Vulnerability Summary

CVE-2006-1326: Multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board 2.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) result_type, (2) search_in, (3) nav, (4) forums, and (5) s parameters in the Search action to index.php; (6) st parameter to index.php with showtopics set to 1; (7) m, (8) y, and (9) d parameters in a calendar action; (10) t parameter in a Print action; (11) MID parameter in a Mail action; (12) HID parameter in a Help action; (13) active parameter in a search action; (14) sort_order, (15) max_results, or (16) sort_key parameter in a Members action.

Impacted Vendors

I
invision_power_services 1

Reference Links

http://www.osvdb.org/25009 http://www.osvdb.org/25010 http://www.osvdb.org/25011 http://www.osvdb.org/25012 http://www.osvdb.org/25013 http://www.osvdb.org/25014 http://www.osvdb.org/25015 http://www.securityfocus.com/archive/1/428015/100/0/threaded http://www.securityfocus.com/bid/17144 http://www.osvdb.org/25009 http://www.osvdb.org/25010 http://www.osvdb.org/25011 http://www.osvdb.org/25012 http://www.osvdb.org/25013 http://www.osvdb.org/25014 http://www.osvdb.org/25015 http://www.securityfocus.com/archive/1/428015/100/0/threaded http://www.securityfocus.com/bid/17144
CVSS v2.0
Source Entity [email protected]
Severity MEDIUM
4.3
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:M/Au:N/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2006-1326 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/27437
View Code
Exploit-DB https://www.exploit-db.com/exploits/27438
View Code
Exploit-DB https://www.exploit-db.com/exploits/27441
View Code
Exploit-DB https://www.exploit-db.com/exploits/27440
View Code
Exploit-DB https://www.exploit-db.com/exploits/27439
View Code
Exploit-DB https://www.exploit-db.com/exploits/27436
View Code
Exploit-DB https://www.exploit-db.com/exploits/27442
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A
Complexity N/A
Privileges N/A
Interaction NONE
CVSS Vector String AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected Stack

No specific products linked.