← back
CVE-2006-1008

CVE-2006-1008

EPSS 1.6%
Multiple cross-site scripting (XSS) vulnerabilities in N8cms 1.1 and 1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) dir and (2) page_id parameter to (a) index.php and (3) userid parameter to (b) mailto.php. NOTE: it is possible that issues 1 and 2 are resultant from SQL injection.
Affected products
n/a · n/a
public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/27331unverifiedexploitdbwww.exploit-db.com/exploits/27332unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://biyosecurity.be/bugs/n8cms.txthttp://secunia.com/advisories/19068http://securityreason.com/securityalert/562https://exchange.xforce.ibmcloud.com/vulnerabilities/24975https://exchange.xforce.ibmcloud.com/vulnerabilities/25126http://www.securityfocus.com/archive/1/427222/100/0/threadedhttp://www.securityfocus.com/bid/16858http://www.vupen.com/english/advisories/2006/0779