CVE-2006-0198: Cross-site scripting (XSS) vulnerability in a certain module, possibly poll or Pool, for XOOPS allows remot...

Security readout for executives and security teams

This CVE describes a cross-site scripting issue in a XOOPS module, possibly Poll or Pool. A malicious comment could include script-like content in an image tag and run in another user's browser. The sources do not identify exact affected versions, a confirmed patch, or active exploitation. Exposure is most likely limited to legacy XOOPS deployments using the affected Poll or Pool module with comments enabled. Because the affected product and versions are listed as n/a, teams need asset inventory and module review to confirm relevance. Treat this as a legacy web-app risk requiring inventory, not an emergency without confirmed exposure. Prioritize if public XOOPS sites still accept comments through old modules, because successful XSS can affect users, admins, and session trust. Mitigation focus: Inventory XOOPS deployments and installed Poll or Pool-like modules.; Check XOOPS and module maintainer guidance for confirmed fixed versions.; Disable or restrict comments on affected modules until reviewed..

Prepared

Jun 29, 2026, 15:05 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.