CVE-2006-3756

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in Geeklog 1.4.0sr4 and earlier, and 1.3.11sr6 and earlier, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors when validating comments in (1) lib-comment.php (1.4.0sr4) or (2) comment.php (0.3.11sr6).

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://jvn.jp/jp/JVN%2381108784/index.htmlThird Party Advisory
http://secunia.com/advisories/21094Third Party Advisory
http://www.geeklog.net/article.php/geeklog-1.4.0sr5Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2006/2865Permissions Required, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27813Third Party Advisory, VDB Entry
http://jvn.jp/jp/JVN%2381108784/index.htmlThird Party Advisory
http://secunia.com/advisories/21094Third Party Advisory
http://www.geeklog.net/article.php/geeklog-1.4.0sr5Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2006/2865Permissions Required, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27813Third Party Advisory, VDB Entry

Timeline

Published: Jul 21, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-37575.0index.php in Zen Cart 1.3.0.2 allows remote attackers to obtain sensitive information via empty (1) _GET[], (2) _SESSION[], (3) _POST[], (4)CVE-2006-37587.5inc/init.php in Archive Mode (Light) in MyBB (aka MyBulletinBoard) 1.1.4 calls the extract function with EXTR_OVERWRITE on HTTP POST and GET CVE-2006-37595.0Unspecified vulnerability in MyBB (aka MyBulletinBoard) 1.1.4, related has unspecified impact and attack vectors related to "user group mani CVE-2006-37607.5Multiple SQL injection vulnerabilities in MyBB (aka MyBulletinBoard) 1.1.4 allow remote attackers to execute arbitrary SQL commands via unsp CVE-2006-37614.3Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.0 RC2 through 1.1.4 allows remote attacke CVE-2006-37627.5The Touch Control ActiveX control 2.0.0.55 allows remote attackers to read and possibly execute arbitrary files via a "file///" URI in the s CVE-2006-37637.5SQL injection vulnerability in category.php in Diesel Joke Site allows remote attackers to execute arbitrary SQL commands via the id paramet CVE-2006-37645.0Till Gerken phpPolls 1.0.3 allows remote attackers to create a new poll via a direct request to phpPollAdmin.php3 with the poll_action param CVE-2006-37654.3Multiple cross-site scripting (XSS) vulnerabilities in Huttenlocher Webdesign hwdeGUEST 2.1.1 and earlier allow remote attackers to inject a CVE-2006-37665.0Darren's $5 Script Archive osDate 1.1.7 and earlier allows users to boost their own ratings via a txtrating parameter with a score greater t CVE-2006-37676.8Cross-site scripting (XSS) vulnerability in showprofile.php in Darren's $5 Script Archive osDate 1.1.7 and earlier allows remote attackers t CVE-2006-37686.4Integer underflow in filecpnt.exe in FileCOPA FTP Server 1.01 before 2006-07-21 allow remote authenticated users to execute arbitrary code v