VulnerabilityModified

CVE-2006-1033

MEDIUM 4.3EPSS 1.95%

Does this matter?

Lower severity and a low EPSS score (1.95%). Track it; it rarely justifies an emergency change on its own.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arbitrary web script or HTML via (1) uname, (2) error, (3) profile or (4) the username filed parameter to the (a) Your_Account module, (5) catid, (6) sid, (7) Story Text or (8) Extended text text fields in the (b) News module, (9) month, (10) year or (11) sa parameter to the (c) Stories_Archive module, (12) show, (13) cid, (14) ratetype, or (15) orderby parameter to the (d) Web_Links module, (16) op, or (17) pollid parameter to the (e) Surveys module, (18) c parameter to the (f) Downloads module, (19) meta, or (20) album parameter to the (g) coppermine module, or the search box in the (21) Search, (22) Stories_Archive, (23) Downloads, and (24) Topics module.

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 1.95% probability · 79th percentile
CISA KEV: Not listed
Affected: cpg-nuke/dragonfly cms
Source: cve@mitre.org

References

http://lostmon.blogspot.com/2006/02/multiple-cross-site-scripting-in.htmlExploit, Vendor Advisory
http://secunia.com/advisories/18940Vendor Advisory
http://securitytracker.com/id?1015661Exploit
http://www.securityfocus.com/bid/16784Exploit
http://www.vupen.com/english/advisories/2006/0688
https://exchange.xforce.ibmcloud.com/vulnerabilities/24843
http://lostmon.blogspot.com/2006/02/multiple-cross-site-scripting-in.htmlExploit, Vendor Advisory
http://secunia.com/advisories/18940Vendor Advisory
http://securitytracker.com/id?1015661Exploit
http://www.securityfocus.com/bid/16784Exploit
http://www.vupen.com/english/advisories/2006/0688
https://exchange.xforce.ibmcloud.com/vulnerabilities/24843

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.