CVE-2006-2028: XSS
Published Apr 26, 2006
·Updated
Cross-site scripting (XSS) vulnerability in imagelist.php in Jeremy Ashcraft Simplog 0.9.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the imagedir parameter. NOTE: this issue might be resultant from directory traversal.
Affected Software
1 affected component
Simplog Simplog<=0.9.3
Event History
Apr 26, 2006
CVE Published
12:06 AM
CVE Published
via MITRE·04:00 AM
Data Sourced
via MITRE·04:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-2028?
CVE-2006-2028 has a medium severity level due to its potential for cross-site scripting exploitation.
2
How do I fix CVE-2006-2028?
To fix CVE-2006-2028, upgrade Simplog to version 0.9.4 or later where the vulnerability is patched.
3
What type of attack does CVE-2006-2028 enable?
CVE-2006-2028 enables remote attackers to perform cross-site scripting attacks by injecting arbitrary web scripts or HTML.
4
Which versions of Simplog are affected by CVE-2006-2028?
CVE-2006-2028 affects Simplog versions 0.9.3 and earlier.
5
What is the root cause of CVE-2006-2028?
The root cause of CVE-2006-2028 is improper validation of the imagedir parameter in imagelist.php.