Cross site scripting

Cross-site scripting XSS vulnerability in Nuked Klan 1.7 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a getURL statement in a .swf file, as demonstrated by "Remote Cookie Disclosure." NOTE: it could be argued that this is an issue in Shockwav...

CVE-2006-6868

Multiple cross-site scripting XSS vulnerabilities in Zen Cart Web Shopping Cart before 1.3.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2006-6882

Cross-site scripting XSS vulnerability in golden book allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2006-6808

Cross-site scripting XSS vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the getfiledescription function in wp-admin/admin-functions.php...

CVE-2006-6778

Cross-site scripting XSS vulnerability in shownews.php in TimberWolf 1.2.2 allows remote attackers to inject arbitrary web script or HTML via the nid parameter...

CVE-2006-6700: Undefined Security Weakness

Cross-site scripting XSS vulnerability in @Mail WebMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended...

CVE-2006-6675

Cross-site scripting XSS vulnerability in Novell NetWare 6.5 Support Pack 5 and 6 and Novell Apache on NetWare 2.0.48 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in Welcome web-app...

CVE-2006-6647

Cross-site scripting XSS vulnerability in the MySite 4.7.x before 4.7.x-3.3 and 5.x before 5.x-1.3 module for Drupal allows remote attackers to inject arbitrary web script or HTML via the Title field when editing a page. NOTE: some details were obtained from third party information...

CVE-2006-6646

Multiple cross-site scripting XSS vulnerabilities in Drupal 1 Project Issue Tracking 4.7.x-1.0 and 4.7.x-2.0, and 2 Project 4.6.x-1.0, 4.7.x-1.0, and 4.7.x-2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, which do not use the checkplain function...

CVE-2006-6626

Cross-site scripting XSS vulnerability in an unspecified component of Moodle 1.5 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element. NOTE: The provenance of this information is unknown; the details are obtained solely from...

CVE-2006-6548

Multiple cross-site scripting XSS vulnerabilities in cPanel WebHost Manager WHM 3.1.0 allow remote authenticated users to inject arbitrary web script or HTML via the domain parameter to 1 scripts2/changeemail, 2 scripts2/limitbw, or 3 scripts/rearrangeacct. NOTE: the feature parameter to...

CVE-2006-6544

Cross-site scripting XSS vulnerability in CM68 News allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-6517

Multiple cross-site scripting XSS vulnerabilities in KDPics 1.16 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 categories parameter to a index.php3 or b galeries.inc.php3...

CVE-2006-6509

Cross-site scripting XSS vulnerability in the skinning feature in SiteKiosk before 6.5.150 allows local users to bypass security protections and inject arbitrary web script or HTML via an ABOUT: URI, which is displayed in the title bar of the browser...

CVE-2006-6544: Undefined Security Weakness

Cross-site scripting XSS vulnerability in CM68 News allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2006-6466

Multiple cross-site scripting XSS vulnerabilities in WBmap.php in WikyBlog 1.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 key, 2 d, 3 l, or 4 v parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third par...

CVE-2006-6388

CVE-2006-6388 is a Cross-site scripting (XSS) vulnerability in LINK Content Management Server (CMS) affecting naprednaPretraga.php via the txtPretraga parameter. The root cause is unsanitized input leading to arbitrary script/HTML injection, with CVSSv2 base score 6.8 (NETWORK, MEDIUM, no authent...

CVE-2006-6375

Cross-site scripting XSS vulnerability in display.php in Simple Machines Forum SMF 1.1 Final and earlier allows remote attackers to inject arbitrary web script or HTML via the contents of a file that is uploaded with the image parameter set, which can be interpreted as script by Internet Explorer...

CVE-2006-6366

Cerberus Helpdesk is affected by a Cross-site scripting (XSS) vulnerability in includes/elements/spellcheck/spellwin.php. The js parameter can be exploited to inject arbitrary script/HTML in versions 0.97.3, 2.0–2.7, 3.2.1, and 3.3. This is a remote issue described in the CVE entry; exploitation ...

CVE-2006-6356

Multiple cross-site scripting XSS vulnerabilities in templates/linktemp.php in PHPNews 1.3.0 allow remote attackers to inject arbitrary web script or HTML via the 1 url, 2 id, 3 subject, 4 username, or 5 time parameter...