CVE-2006-6487: Cross-site scripting (XSS) vulnerability in index.php in DT Guestbook (dt_guestbook) 1.0f, when register_gl...

Security readout for executives and security teams

This is a cross-site scripting flaw in DT Guestbook 1.0f. If the vulnerable guestbook is running with PHP register_globals enabled, an attacker may cause script or HTML to be injected through a request parameter, potentially affecting visitors who view the resulting page. Exposure is limited to deployments of DT Guestbook 1.0f with register_globals enabled, especially if index.php is publicly reachable. The bundle does not identify broader affected products or supported platform versions. Handle as a legacy web-app exposure issue. It is not proven actively exploited here, but public-facing XSS can create customer trust, session, and defacement risk if the old component remains online. Mitigation focus: Identify and remove any DT Guestbook 1.0f deployments no longer needed.; Disable register_globals where this legacy PHP configuration is present.; Restrict public access to the guestbook until vendor guidance is confirmed..

Prepared

Jun 29, 2026, 08:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.