CVE-2006-7050

Status: ModifiedMedium (6.8)—

Cross-site scripting (XSS) vulnerability in WikkaWiki (Wikka Wiki) before 1.1.6.2 allows remote attackers to inject arbitrary javascript via (1) events in forced links (url parameter) that are not properly handled in formatters/wakka.php, and possibly (2) other vectors in wikka.php.

CVSS

Version: 2.0
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Base score: 6.8

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 1.45%
Percentile among all scored CVEs: 73
Score date: 10/9/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Wikkawiki — Wikkawiki

CWEs

NVD-CWE-Other

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2006-7050",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-02-24T00:28:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/20628",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://wikkawiki.org/WikkaReleaseNotes",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://wush.net/trac/wikka/changeset/47",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://wush.net/trac/wikka/ticket/142",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/18481",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/2381",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27227",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/20628",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://wikkawiki.org/WikkaReleaseNotes",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://wush.net/trac/wikka/changeset/47",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://wush.net/trac/wikka/ticket/142",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/18481",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/2381",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27227",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in WikkaWiki (Wikka Wiki) before 1.1.6.2 allows remote attackers to inject arbitrary javascript via (1) events in forced links (url parameter) that are not properly handled in formatters/wakka.php, and possibly (2) other vectors in wikka.php."
    },
    {
      "lang": "es",
      "value": "Vulnerabilida de secuencia de comandos en sitios cruzados (XSS) en WikkaWiki (Wikka Wiki) anterior a 1.1.6.2 permite a atacantes remotos inyectar javascript de su elección a través de (1) eventos en enlaces forzados (parámetro url) que no son manejadas adecuadamente en formatters/wakka.php, y posiblemente (2) otros vectores en wikka.php."
    }
  ],
  "lastModified": "2026-06-16T22:34:17.427",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wikkawiki:wikkawiki:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98ABA654-0C36-4611-87A0-4DC94592BB17",
              "versionEndIncluding": "1.1.6.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}