Description
Cross-site scripting (XSS) vulnerability in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final allows remote attackers to inject arbitrary web script via the background:url property in (1) glow or (2) shadow tags.
Exploits (1)
exploitdb
WORKING POC
VERIFIED
by Cheng Peng Su · textwebappsphp
https://www.exploit-db.com/exploits/23812
References (7)
Core 7
Core References
Various Sources x_refsource_confirm
http://www.yabbforum.com/community/YaBB.pl?board=general%3Baction=display%3Bnum=1093133233
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=107936800226430&w=2
Exploit, Patch, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/11128
Patch, Vendor Advisory vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/9873
Mailing List mailing-list
x_refsource_bugtraq
http://marc.info/?l=bugtraq&m=107948064923981&w=2
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/15488
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1009427
Scores
EPSS
0.0087
EPSS Percentile
75.3%
Details
Status
published
Products (3)
simple_machines/simple_machines_smf
1.0_b
yabb/yabb
1.5.1
yabb/yabb
1_gold_-_sp_1.3
Published
Mar 15, 2004
Tracked Since
Feb 18, 2026