CVE-2006-0923: XSS
First published: Tue Feb 28 2006(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in MyPHPNuke (MPN) 1.88 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the letter parameter in reviews.php and (2) the dcategory parameter in download.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PHP-Nuke | <=1.8.8 | |
| PHP-Nuke | =1.8.8_8_rc2 | |
| PHP-Nuke | =1.8.8_7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.nukedx.com/?viewdoc=12
- http://www.securityfocus.com/bid/16815
- http://secunia.com/advisories/19052
- http://www.myphpnuke.com/article.php?sid=1035&mode=thread&order=0
- http://securityreason.com/securityalert/491
- http://www.vupen.com/english/advisories/2006/0750
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24887
- http://www.securityfocus.com/archive/1/425983/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2006-0923?
CVE-2006-0923 has been classified as a medium severity vulnerability.
How do I fix CVE-2006-0923?
To fix CVE-2006-0923, upgrade MyPHPNuke to version 1.89 or later.
What are the affected versions of MyPHPNuke for CVE-2006-0923?
The affected versions for CVE-2006-0923 are MyPHPNuke 1.88 and earlier.
What kind of vulnerability is CVE-2006-0923?
CVE-2006-0923 is a cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary HTML or web scripts.
Which parameters are involved in CVE-2006-0923?
CVE-2006-0923 involves the 'letter' parameter in reviews.php and the 'dcategory' parameter in download.php.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/myphpnuke
- canonical/php-nuke
- version/php-nuke/1.8.8
- version/php-nuke/1.8.8_8_rc2
- version/php-nuke/1.8.8_7