Login Request a demo
Unscored severity · published Sep 23, 2006
CVE-2006-4964
Cross-site scripting (XSS) vulnerability in MAXdev MDPro 1.0.76 before 20060918 allows remote attackers to inject arbitrary web script or HTML via (1) vectors that bypass the XSS…
–
CVSS
1.4%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in MAXdev MDPro 1.0.76 before 20060918 allows remote attackers to inject arbitrary web script or HTML via (1) vectors that bypass the XSS protection mechanisms of the pnVarCleanFromInput function, and (2) unspecified vectors related to the AntiCracker.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MD
Md-pro · Maxdev
through 1.0.76; 1.0.72; 1.0.73; 1.0.75 · source: NVD
Affected product
MD
Md-pro
Maxdev
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-4964
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-4964
jvn.jp
http://jvn.jp/jp/JVN%2346630603/index.html
Patch
http://secunia.com/advisories/22050
Patch
http://www.maxdev.com/Article605.phtml
Patch
http://www.maxdev.com/Downloads-index-req-dldet-lid-497-ttitle-Security_fix_for_MDPro_1.076.phtml
Patch
http://www.securityfocus.com/bid/20133
www.vupen.com
http://www.vupen.com/english/advisories/2006/3732
More from Md-pro
–
CVE-2006-5565
CRLF injection vulnerability in MAXdev MD-Pro 1.0.76 allows remote attackers to inject arbitrary HTTP headers via a CRLF sequence in the (1) name, (2) file, (3) module, and (4)…
–
CVE-2006-5564
Cross-site scripting (XSS) vulnerability in user.php in MAXdev MD-Pro 1.0.76 allows remote attackers to inject arbitrary web script or HTML via the op parameter
–
CVE-2006-1676
SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro (MD-Pro) 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote…
–
CVE-2006-1677
MAXdev MDPro 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to obtain the full path of the server via a direct request to includes/legacy.php
–
CVE-2005-2887
MAXdev MD-Pro 1.0.73, and possibly earlier versions, allows remote attackers to obtain sensitive information via a direct request to (1) wiki.php, (2) AutoTheme directory, (3)…