CVE-2006-1417

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Caloris Planitia Online Quiz System (aka Web Quiz pro), possibly 1.0, allow remote attackers to inject arbitrary web script or HTML via the (1) exam parameter in prequiz.asp or (2) msg parameter in student.asp.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://pridels0.blogspot.com/2006/03/web-quiz-pro-xss-vuln.html
http://secunia.com/advisories/19416Vendor Advisory
http://www.osvdb.org/24129Exploit
http://www.osvdb.org/24130Exploit
http://www.securityfocus.com/bid/17255Exploit
http://www.vupen.com/english/advisories/2006/1091Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/25431
http://pridels0.blogspot.com/2006/03/web-quiz-pro-xss-vuln.html
http://secunia.com/advisories/19416Vendor Advisory
http://www.osvdb.org/24129Exploit
http://www.osvdb.org/24130Exploit
http://www.securityfocus.com/bid/17255Exploit
http://www.vupen.com/english/advisories/2006/1091Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/25431

Timeline

Published: Mar 28, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-14182.6Cross-site scripting (XSS) vulnerability in default.asp in Caloris Planitia E-School Management System 1.0 and earlier allows remote attacke CVE-2006-14195.0SQL injection vulnerability in the Calendar module in nuked-klan 1.7.5 and earlier allows remote attackers to execute arbitrary SQL commands CVE-2006-14205.0SQL injection vulnerability in print.php in SaphpLesson 2.0 allows remote attackers to execute arbitrary SQL commands via the lessid paramet CVE-2006-14215.1Multiple SQL injection vulnerabilities in akocomment.php in AkoComment 2.0 module for Mambo, with magic_quotes_gpc disabled, allow remote at CVE-2006-14225.0SQL injection vulnerability in details_view.php in PHP Booking Calendar 1.0c and earlier allows remote attackers to execute arbitrary SQL co CVE-2006-14235.0SQL injection vulnerability in showflat.php in UBB.threads 5.5.1, 6.0 br5, 6.0.1, 6.0.2, and earlier, allows remote attackers to execute arb CVE-2006-14254.3Cross-site scripting (XSS) vulnerability in track.php in phpmyfamily 1.4.1 allows remote attackers to inject arbitrary web script or HTML vi CVE-2006-14267.5Multiple SQL injection vulnerabilities in Pixel Motion Blog allow remote attackers to execute arbitrary SQL commands via the (1) date parame CVE-2006-14274.3Multiple cross-site scripting (XSS) vulnerabilities in WebAPP 0.9.9.3.2 and earlier allow remote attackers to inject arbitrary web script or CVE-2006-14284.3Multiple cross-site scripting (XSS) vulnerabilities in phpCOIN 1.2.2 and earlier allow remote attackers to inject arbitrary web script or HT CVE-2006-14294.3Cross-site scripting (XSS) vulnerability in accountlogon.cfm in classifiedZONE 1.2 and earlier allows remote attackers to inject arbitrary w CVE-2006-14304.3Multiple cross-site scripting (XSS) vulnerabilities in CONTROLzx HMS (formerly DRZES) 3.3.4 and earlier allow remote attackers to inject arb