Unscored severity · published Nov 10, 2006
CVE-2006-5830
Multiple cross-site scripting (XSS) vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to inject arbitrary web script or HTML via the…
–
CVSS
2.4%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) topid, (2) forid, and (3) catid parameters to code/cp_forum_view.php; (4) choosed_language parameter to cp_dpage.php; (5) orderdir parameter to cp_links_search.php; (6) order_field parameter to (a) cp_show_ec_products.php and (b) cp_users_online.php; and the (7) signature and (8) fiscal code fields in the user profile.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.4% · higher than 84% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AI
Aiocp · Aiocp
1.3.000; 1.3.001; 1.3.002; 1.3.003; 1.3.004; 1.3.005; +2 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-5830
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-5830
Vendor Advisory
http://secunia.com/advisories/22719
securityreason.com
http://securityreason.com/securityalert/1839
sourceforge.net
http://sourceforge.net/project/shownotes.php?release_id=478370
www.securityfocus.com
http://www.securityfocus.com/archive/1/450701/100/0/threaded
Exploit
http://www.securityfocus.com/bid/20931
www.vupen.com
http://www.vupen.com/english/advisories/2006/4378
More from Aiocp
–
CVE-2008-4782
SQL injection vulnerability in public/code/cp_polls_results.php in All In One Control Panel (AIOCP) 1.4 allows remote attackers to execute arbitrary SQL commands via the poll_id…
–
CVE-2007-3120
Cross-site scripting (XSS) vulnerability in public/code/cp_dpage.php in All In One Control Panel (AIOCP) before 1.3.017 allows remote attackers to inject arbitrary web script or…
–
CVE-2007-2624
Dynamic variable evaluation vulnerability in shared/config/cp_config.php in All In One Control Panel (AIOCP) before 1.3.016 allows remote attackers to conduct cross-site scripting…
–
CVE-2007-2625
Cross-site scripting (XSS) vulnerability in shared/code/cp_authorization.php in All In One Control Panel (AIOCP) before 1.3.016 allows remote attackers to inject arbitrary web…
–
CVE-2006-5829
Multiple SQL injection vulnerabilities in All In One Control Panel (AIOCP) 1.3.007 and earlier allow remote attackers to execute arbitrary SQL commands via the (1)…