Published: 28/12/2006 Updated: 29/07/2017

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 685

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote malicious users to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the get_file_description function in wp-admin/admin-functions.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
wordpress wordpress 0.71
wordpress wordpress 1.2
wordpress wordpress 1.5.2
wordpress wordpress 0.6.2.1
wordpress wordpress 1.5
wordpress wordpress 1.5.1
wordpress wordpress 2.0.4
wordpress wordpress
wordpress wordpress 0.6.2
wordpress wordpress 0.7
wordpress wordpress 1.5.1.2
wordpress wordpress 1.5.1.3
wordpress wordpress 2.0
wordpress wordpress 1.2.1
wordpress wordpress 1.2.2
wordpress wordpress 2.0.1
wordpress wordpress 2.0.2
wordpress wordpress 2.0.3

Debian Bug report logs - #405691 wordpress: new upstream: 206 Package: wordpress; Maintainer for wordpress is Craig Small <csmall@debianorg>; Source for wordpress is src:wordpress (PTS, buildd, popcon) Reported by: Kees Cook <kees@outfluxnet> Date: Fri, 5 Jan 2007 17:18:21 UTC Severity: grave Tags: security Fo ...

Debian Bug report logs - #405299 FrSIRT/ADV-2006-5191: WordPress "get_file_description()" Function Client-Side Cross Site Scripting Vulnerability Package: wordpress; Maintainer for wordpress is Craig Small <csmall@debianorg>; Source for wordpress is src:wordpress (PTS, buildd, popcon) Reported by: Enrique Garcia <kike+bt ...

source: wwwsecurityfocuscom/bid/21782/info Wordpress is prone to an HTML-injection scripting vulnerability because the application fails to properly sanitize user-supplied input Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authenticatio ...

NVD-CWE-Other http://michaeldaw.org/http://trac.wordpress.org/changeset/4665 http://www.securityfocus.com/bid/21782 http://secunia.com/advisories/23587 http://security.gentoo.org/glsa/glsa-200701-10.xml http://secunia.com/advisories/23741 http://www.vupen.com/english/advisories/2006/5191 http://marc.info/?l=full-disclosure&m=116722128631087&w=2 https://exchange.xforce.ibmcloud.com/vulnerabilities/31133 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=405691 https://www.exploit-db.com/exploits/29356/

CVE-2006-6808

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect