CVE-2006-0330

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in Gallery before 1.5.2 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, possibly involving the user name (fullname).

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=325285
http://gallery.menalto.com/page/gallery_1_5_2_release
http://secunia.com/advisories/18557Patch, Vendor Advisory
http://secunia.com/advisories/18627Patch, Vendor Advisory
http://secunia.com/advisories/21502
http://www.gentoo.org/security/en/glsa/glsa-200601-13.xmlPatch, Vendor Advisory
http://www.osvdb.org/22660Patch
http://www.securityfocus.com/bid/16334Patch
http://www.us.debian.org/security/2006/dsa-1148
http://www.vupen.com/english/advisories/2006/0282
https://exchange.xforce.ibmcloud.com/vulnerabilities/24247
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=325285
http://gallery.menalto.com/page/gallery_1_5_2_release
http://secunia.com/advisories/18557Patch, Vendor Advisory
http://secunia.com/advisories/18627Patch, Vendor Advisory
http://secunia.com/advisories/21502
http://www.gentoo.org/security/en/glsa/glsa-200601-13.xmlPatch, Vendor Advisory
http://www.osvdb.org/22660Patch
http://www.securityfocus.com/bid/16334Patch
http://www.us.debian.org/security/2006/dsa-1148
http://www.vupen.com/english/advisories/2006/0282
https://exchange.xforce.ibmcloud.com/vulnerabilities/24247

Timeline

Published: Jan 21, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-03314.6Buffer overflow in Change passwd 3.1 (chpasswd) SquirrelMail plugin allows local users to execute arbitrary code via long command line argum CVE-2006-03326.4Pantomime in Ecartis 1.0.0 snapshot 20050909 stores e-mail attachments in a publicly accessible directory, which may allow remote attackers CVE-2006-03334.3Cross-site scripting (XSS) vulnerability in ar-blog 5.2 allows remote attackers to inject arbitrary web script or HTML via the (1) month or CVE-2006-03344.3Cross-site scripting (XSS) vulnerability in search.php in My Amazon Store Manager 1.0 allows remote attackers to inject arbitrary web script CVE-2006-03355.0Multiple unspecified vulnerabilities in Kerio WinRoute Firewall before 6.1.4 Patch 1 allow remote attackers to cause a denial of service via CVE-2006-03365.0Kerio WinRoute Firewall before 6.1.4 Patch 2 allows attackers to cause a denial of service (CPU consumption and hang) via unknown vectors in CVE-2006-03377.5Buffer overflow in multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 a CVE-2006-03385.0Multiple F-Secure Anti-Virus products and versions for Windows and Linux, including Anti-Virus for Windows Servers 5.52 and earlier, Interne CVE-2006-03397.5Buffer overflow in BitComet Client 0.60 allows remote attackers to execute arbitrary code, when the publisher's name link is clicked, via a CVE-2006-03407.1Unspecified vulnerability in Stack Group Bidding Protocol (SGBP) support in Cisco IOS 12.0 through 12.4 running on various Cisco products, w CVE-2006-03414.3Cross-site scripting (XSS) vulnerability in WCONSOLE.DLL in Rockliffe MailSite 5.x and 6.1.22 and earlier allows remote attackers to inject CVE-2006-03427.8RockLiffe MailSite HTTP Mail management agent (httpma) 7.0.3.1 allows remote attackers to cause a denial of service (CPU consumption and cra