CVE-2006-2746

Опубликовано: 01 июн. 2006

Источник: nvd

CVSS2: 6.8

EPSS Средний

Описание

Multiple cross-site scripting (XSS) vulnerabilities in F@cile Interactive Web 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) lang parameter in index.php, and the (2) mytheme and (3) myskin parameters in multiple "p-themes" index.inc.php files including (c) lowgraphic, (d) classic, (e) puzzle, (f) simple, and (g) ciao. NOTE: vectors 2 and 3 might be resultant from file inclusion issues.

Ссылки

http://secunia.com/advisories/20358
Exploit
Vendor Advisory
http://securityreason.com/securityalert/1010
http://www.nukedx.com/?getxpl=35
Exploit
http://www.nukedx.com/?viewdoc=35
Exploit
Vendor Advisory
http://www.osvdb.org/26104
http://www.osvdb.org/26105
http://www.securityfocus.com/archive/1/435283/100/0/threaded
http://www.securityfocus.com/bid/18151
Exploit
http://www.vupen.com/english/advisories/2006/2036
http://secunia.com/advisories/20358
Exploit
Vendor Advisory
http://securityreason.com/securityalert/1010
http://www.nukedx.com/?getxpl=35
Exploit
http://www.nukedx.com/?viewdoc=35
Exploit
Vendor Advisory
http://www.osvdb.org/26104
http://www.osvdb.org/26105
http://www.securityfocus.com/archive/1/435283/100/0/threaded
http://www.securityfocus.com/bid/18151
Exploit
http://www.vupen.com/english/advisories/2006/2036

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:facile_interactive_web:facile_interactive_web:*:*:*:*:*:*:*:*

Версия до 0.8.5 (включая)

cpe:2.3:a:facile_interactive_web:facile_interactive_web:0.8.41:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.13536

Средний

6.8 Medium

CVSS2

Дефекты

NVD-CWE-Other

Связанные уязвимости

GHSA-p3v3-gr5g-j32c

github

почти 4 года назад