Unscored severity · published Mar 14, 2006
CVE-2006-1233
Multiple cross-site scripting (XSS) vulnerabilities in WMNews allow remote attackers to inject arbitrary web script or HTML via the (1) ArtCat parameter to wmview.php, (2)…
–
CVSS
2.5%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in WMNews allow remote attackers to inject arbitrary web script or HTML via the (1) ArtCat parameter to wmview.php, (2) ctrrowcol parameter to footer.php, or (3) ArtID parameter to wmcomments.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WM
Wmnews · Mikael Software
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-1233
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-1233
Exploit
http://biyosecurity.be/bugs/wmnews.txt
Vendor Advisory
http://secunia.com/advisories/19204
www.osvdb.org
http://www.osvdb.org/23840
www.osvdb.org
http://www.osvdb.org/23841
www.osvdb.org
http://www.osvdb.org/23842
www.securityfocus.com
http://www.securityfocus.com/archive/1/427479/100/0/threaded
More from Wmnews
–
CVE-2006-3928
PHP remote file inclusion vulnerability in index.php in WMNews 0.2a and earlier allows remote attackers to execute arbitrary PHP code via a URL in the base_datapath parameter