CVE-2006-1397 json
Multiple cross-site scripting (XSS) vulnerabilities in (a) phpAdsNew and (b) phpPgAds before 2.0.8 allow remote attackers to inject arbitra…
published 2006-03-28 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-1401
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.9%
- EPSS 1.9% chance of exploitation in 30 days, percentile 79%
- public exploits
- 0
- none known
Summary
Multiple cross-site scripting (XSS) vulnerabilities in (a) phpAdsNew and (b) phpPgAds before 2.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) certain parameters to the banner delivery module, which is not properly handled in the administrator interface, or (2) certain parameters to the login form.
Patch / fix
Exploit prediction
1.91% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
References
-
sourceforge.net
/project/shownotes.php?release_id=404964
patch
-
secunia.com
/advisories/19384
third-party-advisory, patch, vendor-advisory
-
securityfocus.com
/bid/17251
vdb-entry, patch
-
securitytracker.com
/id?1015829
vdb-entry, patch
-
securitytracker.com
/id?1015828
vdb-entry, patch
-
sourceforge.net
/project/shownotes.php?release_id=404963
patch
-
exchange.xforce.ibmcloud.com
/vulnerabilities/25458
vdb-entry
-
osvdb.org
/24206
vdb-entry
-
securityreason.com
/securityalert/633
third-party-advisory
-
vupen.com
/english/advisories/2006/1107
vdb-entry
- phpadsnew.com /two/nucleus/index.php?itemid=46
-
securityfocus.com
/archive/1/428898/100/0/threaded
mailing-list
-
osvdb.org
/24205
vdb-entry
Sources
- CVE List CVE-2006-1397
- NVD CVE-2006-1397
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.