CVE-2006-1427: XSS
First published: Tue Mar 28 2006(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in WebAPP 0.9.9.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) action, (2) id, (3) num, (4) board, (5) cat, (6) real, (7) viewcat, (8) img, or (9) curcatname parameter in cgi-bin/index.cgi, or (10) vsSD parameter in /mods/calendar/index.cgi.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WebAPP | =0.9.9.3 | |
| WebAPP | =0.9.9.3.2 | |
| WebAPP | =0.9.9.2.1 | |
| WebAPP | =0.9.9.2 | |
| WebAPP | =0.9.9.1 | |
| WebAPP | =0.9.9.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.osvdb.org/24278
- http://www.osvdb.org/24279
- http://www.securityfocus.com/bid/17359
- http://secunia.com/advisories/19506
- http://www.web-app.net/cgi-bin/index.cgi?action=downloadinfo&cat=pastversions&id=1
- http://www.web-app.net/cgi-bin/index.cgi?action=redirectd&cat=pastversions&id=1
- http://pridels0.blogspot.com/2006/03/webapp-multiple-xss-vuln.html
- http://www.vupen.com/english/advisories/2006/1102
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25435
Frequently Asked Questions
What is the severity of CVE-2006-1427?
CVE-2006-1427 is classified as a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary scripts on affected WebAPP installations.
How do I fix CVE-2006-1427?
To fix CVE-2006-1427, upgrade to the latest version of WebAPP that contains patches for these cross-site scripting vulnerabilities.
What versions of WebAPP are affected by CVE-2006-1427?
CVE-2006-1427 affects WebAPP versions 0.9.9.3.2 and earlier, including 0.9.9.3, 0.9.9.3.1, 0.9.9.2, and 0.9.9.1.
How does CVE-2006-1427 expose users to risks?
CVE-2006-1427 exposes users to risks by allowing attackers to inject malicious web scripts through various parameters, potentially leading to data theft or session hijacking.
Can CVE-2006-1427 be exploited without user interaction?
Yes, CVE-2006-1427 can be exploited without user interaction, making it a serious threat for users visiting compromised or malicious sites.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/web-app.org
- canonical/webapp
- version/webapp/0.9.9.3
- version/webapp/0.9.9.3.2
- version/webapp/0.9.9.2.1
- version/webapp/0.9.9.2
- version/webapp/0.9.9.1
- version/webapp/0.9.9.3.1