CVE-2006-2545

Multiple cross-site scripting (XSS) vulnerabilities in Xtreme Topsites 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter in stats.php and (2) unspecified inputs in lostid.php, probably the searchthis parameter. NOTE: one or more of these vectors might be resultant from SQL injection.

CVSS v2.0 2.6 LOW

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/20192	Vendor Advisory
http://securityreason.com/securityalert/945
http://www.osvdb.org/25702
http://www.securityfocus.com/archive/1/434568/100/0/threaded
http://www.securityfocus.com/bid/18055
http://www.vupen.com/english/advisories/2006/1899	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/26614
http://secunia.com/advisories/20192	Vendor Advisory
http://securityreason.com/securityalert/945
http://www.osvdb.org/25702
http://www.securityfocus.com/archive/1/434568/100/0/threaded
http://www.securityfocus.com/bid/18055
http://www.vupen.com/english/advisories/2006/1899	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/26614

Configurations

Configuration 1 (hide)

cpe:2.3:a:xtreme_scripts:xtreme_topsites:1.1:*:*:*:*:*:*:*

History

No history.

Information

Published : 2006-05-23 10:06

Updated : 2025-04-03 01:03

NVD link : CVE-2006-2545

Mitre link : CVE-2006-2545

CVE.ORG link : CVE-2006-2545

JSON object : View

Products Affected

xtreme_scripts

xtreme_topsites

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2006-2545", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-05-23T10:06:00.000", "references": [{"url": "http://secunia.com/advisories/20192", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/945", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/25702", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/434568/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/18055", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/1899", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26614", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/20192", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://securityreason.com/securityalert/945", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.osvdb.org/25702", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/434568/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/18055", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2006/1899", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26614", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Xtreme Topsites 1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter in stats.php and (2) unspecified inputs in lostid.php, probably the searchthis parameter. NOTE: one or more of these vectors might be resultant from SQL injection."}], "lastModified": "2025-04-03T01:03:51.193", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xtreme_scripts:xtreme_topsites:1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8755CA5C-27D2-41AA-A9C8-DEFBA6338DE7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}