CVE-2006-4577

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in The Address Book 1.04e allow remote attackers to inject arbitrary web script or HTML via Javascript events in the (1) email, (2) websites, and (3) groupAddName parameters in (a) save.php; the (4) errorMsg parameter in (b) index.php; and the (5) goTo and (6) search parameters in (c) search.php.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published
Dec 31, 2006
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2006

CVE-2006-45787.5export.php in The Address Book 1.04e writes username and password hash information into a publicly accessible file when dumping the MySQL daCVE-2006-45795.0Directory traversal vulnerability in users.php in The Address Book 1.04e allows remote attackers to include arbitrary files via a .. (dot doCVE-2006-45807.5register.php in The Address Book 1.04e allows remote attackers to bypass the "Allow User Self-Registration" setting and create arbitrary useCVE-2006-45815.0Unrestricted file upload vulnerability in The Address Book 1.04e validates the Content-Type header but not the file extension, which allows CVE-2006-45825.0Cross-site request forgery (CSRF) vulnerability in The Address Book 1.04e allows remote attackers to perform unauthorized actions as other uCVE-2006-45837.5Multiple PHP remote file inclusion vulnerabilities in FlashChat before 4.6.2 allow remote attackers to execute arbitrary PHP code via a URL CVE-2006-45847.5Tr Forum 2.0 allows remote attackers to bypass authentication and add an administrative account via the login and password parameters to admCVE-2006-45859.0SQL injection vulnerability in admin/editer.php in Tr Forum 2.0 allows remote authenticated users to execute arbitrary SQL commands via the CVE-2006-45865.5The admin panel in Tr Forum 2.0 accepts a username and password hash for authentication, which allows remote authenticated users to perform CVE-2006-45876.8Multiple cross-site scripting (XSS) vulnerabilities in vtiger CRM 4.2.4, and possibly earlier, allow remote attackers to inject arbitrary weCVE-2006-45887.5vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct requCVE-2006-45897.5PHP remote file inclusion vulnerability in 0_admin/modules/Wochenkarte/frontend/index.php in DynCMS 6 and earlier allows remote attackers to
CVE-2006-4577: Medium severity, CVSS 6.8 | Vulnix