CVEvulnerability

CVE-2006-0800

2.6 LOW Published 2006-02-20 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-02-20
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
2.6 LOW — AV:N/AC:H/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character, which is interpreted as a ">" character by some web browsers but bypasses the blacklist protection in (1) the pnVarCleanFromInput function in pnAPI.php, (2) the pnSecureInput function in pnAntiCracker.php, and (3) the htmltext parameter in an edituser operation to user.php.

Affected configurations

• postnuke software foundation postnuke 0.7 • postnuke software foundation postnuke 0.62 • postnuke software foundation postnuke 0.63 • postnuke software foundation postnuke 0.64 • postnuke software foundation postnuke 0.70 • postnuke software foundation postnuke 0.71 • postnuke software foundation postnuke 0.72 • postnuke software foundation postnuke 0.73 • postnuke software foundation postnuke 0.74 • postnuke software foundation postnuke 0.75 • postnuke software foundation postnuke 0.75 rc3 • postnuke software foundation postnuke 0.76 rc4 • postnuke software foundation postnuke 0.76 rc4a • postnuke software foundation postnuke 0.76 rc4b • postnuke software foundation postnuke 0.703 • postnuke software foundation postnuke 0.721 • postnuke software foundation postnuke 0.726.3 • postnuke software foundation postnuke 0.761 • postnuke software foundation postnuke 0.761a

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References