CVEvulnerability
CVE-2006-2746
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2006-06-01
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Description
Multiple cross-site scripting (XSS) vulnerabilities in F@cile Interactive Web 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) lang parameter in index.php, and the (2) mytheme and (3) myskin parameters in multiple "p-themes" index.inc.php files including (c) lowgraphic, (d) classic, (e) puzzle, (f) simple, and (g) ciao. NOTE: vectors 2 and 3 might be resultant from file inclusion issues.
Affected configurations
• facile interactive web facile interactive web (<= 0.8.5)
• facile interactive web facile interactive web 0.8.41
References
- http://secunia.com/advisories/20358 Exploit, Vendor Advisory
- http://securityreason.com/securityalert/1010 securityreason.com
- http://www.nukedx.com/?getxpl=35 Exploit
- http://www.nukedx.com/?viewdoc=35 Exploit, Vendor Advisory
- http://www.osvdb.org/26104 www.osvdb.org
- http://www.osvdb.org/26105 www.osvdb.org
- http://www.securityfocus.com/archive/1/435283/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/18151 Exploit
- http://www.vupen.com/english/advisories/2006/2036 www.vupen.com
- http://secunia.com/advisories/20358 Exploit, Vendor Advisory
- http://securityreason.com/securityalert/1010 securityreason.com
- http://www.nukedx.com/?getxpl=35 Exploit
- http://www.nukedx.com/?viewdoc=35 Exploit, Vendor Advisory
- http://www.osvdb.org/26104 www.osvdb.org
- http://www.osvdb.org/26105 www.osvdb.org
- http://www.securityfocus.com/archive/1/435283/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/18151 Exploit
- http://www.vupen.com/english/advisories/2006/2036 www.vupen.com