Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2006-0800

Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character, which is interpreted as a ">" character by some web browsers but bypasses the blacklist protection in (1) the pnVarCleanFromInput function in pnAPI.php, (2) the pnSecureInput function in pnAntiCracker.php, and (3) the htmltext parameter in an edituser operation to user.php.

Published

2006-02-20T22:02:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 2.6 (LOW)

CVSSv2 Vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: HIGH
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

4.9

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-79
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application postnuke_software_foundation postnuke 0.7 Yes
Application postnuke_software_foundation postnuke 0.62 Yes
Application postnuke_software_foundation postnuke 0.63 Yes
Application postnuke_software_foundation postnuke 0.64 Yes
Application postnuke_software_foundation postnuke 0.70 Yes
Application postnuke_software_foundation postnuke 0.71 Yes
Application postnuke_software_foundation postnuke 0.72 Yes
Application postnuke_software_foundation postnuke 0.73 Yes
Application postnuke_software_foundation postnuke 0.74 Yes
Application postnuke_software_foundation postnuke 0.75 Yes
Application postnuke_software_foundation postnuke 0.75_rc3 Yes
Application postnuke_software_foundation postnuke 0.76_rc4 Yes
Application postnuke_software_foundation postnuke 0.76_rc4a Yes
Application postnuke_software_foundation postnuke 0.76_rc4b Yes
Application postnuke_software_foundation postnuke 0.703 Yes
Application postnuke_software_foundation postnuke 0.721 Yes
Application postnuke_software_foundation postnuke 0.726.3 Yes
Application postnuke_software_foundation postnuke 0.761 Yes
Application postnuke_software_foundation postnuke 0.761a Yes
References