Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2006-4742: PhpLinkExchange 1.0 allows attackers to inject script via user_add

CVE-2006-4742 · published 20 years ago

Summary

The user_add.php page in PhpLinkExchange 1.0 can be tricked into running malicious web code supplied in the msg field. This could let an attacker display fake pages, steal login information, or take over user sessions. Apply the vendor's update or add proper input filtering to block the dangerous characters.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
idevspot	phplinkexchange	1.0 `cpe:2.3:a:idevspot:phplinkexchange:1.0:::::::*`

Original advisory text

Cross-site scripting (XSS) vulnerability in user_add.php in IDevSpot PhpLinkExchange 1.0 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.3 Medium

Exploitation

2% chance of attack within 30 days

Timeline

Published13 Sep 2006

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2006-4742 · NVD

Track software like this

Free during beta