CVE-2006-0102: Ralph Capper Tinyphpforum

Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in TinyPHPForum (TPF) 3.6 and earlier allows remote attackers to inject arbitrary web script via a javascript: scheme in an "[a]" bbcode tag, possibly the txt parameter to action.php.

Affected products

• Ralph Capper Tinyphpforum: version 3.5 only; version 3.6 only; version 3.46 only; version 3.47 only; version 3.48 only; version 3.49 only; …

Published 2006-01-06. Last modified 2026-06-16.