« Volver al listado

CVE-2006-0800

Estado: ModificadaBaja (2.6)—

Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character, which is interpreted as a ">" character by some web browsers but bypasses the blacklist protection in (1) the pnVarCleanFromInput function in pnAPI.php, (2) the pnSecureInput function in pnAntiCracker.php, and (3) the htmltext parameter in an edituser operation to user.php.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Postnuke Software Foundation — Postnuke

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-0800",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-02-20T22:02:00.000",
  "references": [
    {
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0469.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://news.postnuke.com/index.php?name=News&file=article&sid=2754",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/18937",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/454",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/16752",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/0673",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24823",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0469.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://news.postnuke.com/index.php?name=News&file=article&sid=2754",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/18937",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/454",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/16752",
      "tags": [
        "Exploit",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/0673",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24823",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing \"<\" character, which is interpreted as a \">\" character by some web browsers but bypasses the blacklist protection in (1) the pnVarCleanFromInput function in pnAPI.php, (2) the pnSecureInput function in pnAntiCracker.php, and (3) the htmltext parameter in an edituser operation to user.php."
    }
  ],
  "lastModified": "2026-06-16T22:21:18.810",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F30D2AF-1E7F-4426-8D34-84C86408CFA1"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.62:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB291E9E-3002-4A68-A3E8-B3A6FF4D4E4E"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.63:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8738C97F-A6A7-4EC6-84A6-D38A7D2E4E57"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.64:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DD378628-2AA0-4244-A4D7-8591BEB7A926"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.70:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED90D204-84B5-4EA4-B21D-A6CE37E45CFB"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.71:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D14AA995-3B50-4B91-9634-0D63B0BD35EE"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.72:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "170103EA-D233-41B4-AD68-4572F1E80083"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.73:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "051796A2-A488-4B15-90F8-DEB1E4CC50DB"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.74:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B2C79DB-7655-46A9-965D-5E3246E84B14"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.75:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC7C7203-45C9-4FE4-BFB8-BF2FC3052B2D"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.75_rc3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "078F46F4-9F7D-4BDC-B915-11D8F11ADFC9"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.76_rc4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DE44C155-EDF6-4F4C-81A5-201BD561843F"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.76_rc4a:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58BE1A1F-0A0C-4965-9AC2-6E547B0EE582"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.76_rc4b:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B73A09B4-83C0-47DE-A199-F2A490527263"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.703:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFC564FD-9700-4979-93C0-BA93E57FEF03"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.721:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "60750FE6-4A12-4F30-85C3-D259428537CD"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.726.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF825CA0-8E1C-41D0-B42B-11D03B52844E"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.761:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C55DA346-A7A0-466F-90D7-CC1E7C2E9EFD"
            },
            {
              "criteria": "cpe:2.3:a:postnuke_software_foundation:postnuke:0.761a:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4EB4E7B-29AF-479F-AF9C-3AE84FBDB603"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}