CVE-2006-2016: XSS
Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dn parameter in (a) compareform.php, (b) copyform.php, (c) renameform.php, (d) templateengine.php, and (e) deleteform.php; (2) scope parameter in (f) search.php; and (3) Container DN, (4) Machine Name, and (5) UID Number fields in (g) templateengine.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-2016?
CVE-2006-2016 has a moderate severity rating due to its potential for remote code execution through XSS attacks.
How do I fix CVE-2006-2016?
To fix CVE-2006-2016, upgrade phpLDAPadmin to version 0.9.9 or later, which addresses these vulnerabilities.
What products are vulnerable to CVE-2006-2016?
CVE-2006-2016 affects phpLDAPadmin versions 0.9.8 and earlier, as well as specific versions of Debian GNU/Linux 3.0 and 3.1.
What types of attacks can exploit CVE-2006-2016?
CVE-2006-2016 can be exploited through cross-site scripting (XSS) attacks allowing attackers to execute arbitrary scripts in users' browsers.
Who is at risk due to CVE-2006-2016?
Users and administrators of phpLDAPadmin prior to version 0.9.9, especially those using Debian versions 3.0 and 3.1, are at risk due to CVE-2006-2016.