CVE-2006-0916: Mozilla Bugzilla

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

Bugzilla 2.19.3 through 2.20 does not properly handle "//" sequences in URLs when redirecting a user from the login form, which could cause it to generate a partial URL in a form action that causes the user's browser to send the form data to another domain.

Affected products

• Mozilla Bugzilla: version 2.19.3 only; version 2.20 only; version 2.21 only; version 2.21.1 only; version 2.21.2 only

Published 2006-02-28. Last modified 2026-06-16.