CVE-2006-5770

Multiple cross-site scripting (XSS) vulnerabilities in ac4p Mobile allow remote attackers to inject arbitrary web script or HTML via (1) Bloks, (2) Newnews, (3) lBlok, and (4) foooot parameter in (a) index.php; Newnews, (5) newmsgs, and Bloks parameter in (b) MobileNews.php; Newnews parameter in (c) polls.php; (6) cats parameter in (d) send.php; (7) footer parameter in (e) up.php; and (8) pagenav parameter in (f) cp/index.php.

CVSS v2.0 NVD

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

2.78% chance of exploitation in the next 30 days, 86th percentile

Published

2006-11-06

Updated

2024-08-07

ExploitDB entries (6)

• https://www.exploit-db.com/exploits/28905
• https://www.exploit-db.com/exploits/28904
• https://www.exploit-db.com/exploits/28903
• https://www.exploit-db.com/exploits/28902
• https://www.exploit-db.com/exploits/28901
• https://www.exploit-db.com/exploits/28900

Security advisories

• http://www.securityfocus.com/bid/20895

References

• CVE Record
• NVD entry