CVE-2006-1135

CVE-2006-1135 describes multiple cross-site scripting (XSS) vulnerabilities in sBlog version 0.7.2. These flaws allow remote attackers to inject arbitrary web script or HTML through the 'keyword' parameter in search.php or the 'username' parameter in comments_do.php. With a CVSS score of 4.3, this vulnerability has a network attack vector and medium attack complexity, potentially leading to information compromise (e.g., session hijacking) but not impacting confidentiality or availability. While not listed on the KEV catalog or Hot List, exploit code is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion.