CVE-2006-0676: XSS
Published Feb 13, 2006
·Updated
Cross-site scripting (XSS) vulnerability in header.php in PHP-Nuke 6.0 to 7.8 allows remote attackers to inject arbitrary web script or HTML via the pagetitle parameter.
Affected Software
18 affected components
Francisco Burzi PHP-Nuke=6.0
Francisco Burzi PHP-Nuke=6.5
Francisco Burzi PHP-Nuke=6.5_beta1
Francisco Burzi PHP-Nuke=6.5_final
Francisco Burzi PHP-Nuke=6.5_rc1
Francisco Burzi PHP-Nuke=6.5_rc2
Francisco Burzi PHP-Nuke=6.5_rc3
Francisco Burzi PHP-Nuke=6.6
Francisco Burzi PHP-Nuke=6.7
Francisco Burzi PHP-Nuke=6.9
Francisco Burzi PHP-Nuke=7.0
Francisco Burzi PHP-Nuke=7.1
Francisco Burzi PHP-Nuke=7.2
Francisco Burzi PHP-Nuke=7.3
Francisco Burzi PHP-Nuke=7.6
Francisco Burzi PHP-Nuke=7.7
Francisco Burzi PHP-Nuke=7.8
Francisco Burzi PHP-Nuke=7.9
Event History
Feb 13, 2006
CVE Published
10:02 PM
Feb 14, 2006
CVE Published
via MITRE·03:00 AM
Data Sourced
via MITRE·03:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-0676?
CVE-2006-0676 has a medium severity level as it allows for cross-site scripting (XSS) attacks.
2
How do I fix CVE-2006-0676?
To fix CVE-2006-0676, ensure that proper input validation is implemented for the pagetitle parameter in header.php.
3
Which versions of PHP-Nuke are affected by CVE-2006-0676?
CVE-2006-0676 affects PHP-Nuke versions 6.0 through 7.8.
4
What types of attacks can be executed using CVE-2006-0676?
CVE-2006-0676 can be exploited for cross-site scripting attacks, allowing attackers to inject arbitrary web scripts or HTML.
5
Is there a patch available for CVE-2006-0676?
There are no specific patches listed, but upgrading to a fixed version of PHP-Nuke is recommended to mitigate CVE-2006-0676.