CVE-2006-7149

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.x allow remote attackers to inject arbitrary web script or HTML via (1) the query string to (a) index.php, which reflects the string in an error message from mod_login.php; and the (2) mcname parameter to (b) moscomment.php and (c) com_comment.php.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://securityreason.com/securityalert/2379
http://www.kapda.ir/advisory-444.htmlExploit, Vendor Advisory
http://www.securityfocus.com/archive/1/449305/100/0/threaded
http://www.securityfocus.com/bid/20650Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/29708
http://securityreason.com/securityalert/2379
http://www.kapda.ir/advisory-444.htmlExploit, Vendor Advisory
http://www.securityfocus.com/archive/1/449305/100/0/threaded
http://www.securityfocus.com/bid/20650Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/29708

Timeline

Published: Mar 7, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-71507.5Multiple SQL injection vulnerabilities in Mambo 4.6.x allow remote attackers to execute arbitrary SQL commands via the mcname parameter to (CVE-2006-71516.6Untrusted search path vulnerability in the libtool-ltdl library (libltdl.so) 1.5.22-2.3 in Fedora Core 5 might allow local users to execute CVE-2006-71528.5default.asp in ASP-Nuke Community 1.5 and earlier allows remote attackers to gain privileges by setting certain pseudo cookie values.CVE-2006-715310.0PHP remote file inclusion vulnerability in index.php in MiniBB Forum 2 allows remote attackers to execute arbitrary code via a URL in the pa CVE-2006-71545.0Iono allows remote attackers to obtain the full server path via certain requests to (1) templates/iono/admin/denied.tpl.php, (2) templates/i CVE-2006-71557.5Novell BorderManager 3.8 SP4 generates the same ISAKMP cookies for the same source IP and port number during the same day, which allows remo CVE-2006-715610.0PHP remote file inclusion vulnerability in addon_keywords.php in Keyword Replacer (keyword_replacer) 1.0 and earlier, a module for miniBB, a CVE-2006-71577.1Buffer overflow in Google Earth v4.0.2091 (beta) allows remote user-assisted attackers to cause a denial of service (crash) via a KML or KMZ CVE-2006-71584.3Cross-site scripting (XSS) vulnerability in Oracle Application Express (APEX) before 2.2.1, aka Oracle HTML DB, allows remote attackers to i CVE-2006-71596.4Directory traversal vulnerability in include/prune_torrents.php in BTI-Tracker 1.3.2 (aka btitracker) allows remote attackers to delete arbi CVE-2006-71604.9The Sandbox.sys driver in Outpost Firewall PRO 4.0, and possibly earlier versions, does not validate arguments to hooked SSDT functions, whi CVE-2006-71617.5SQL injection vulnerability in giris_yap.asp in Hazir Site 2.0 allows remote attackers to bypass authentication via the (1) k_a class or (2)