{"api_version":"1","generated_at":"2026-07-23T10:24:06+00:00","cve":"CVE-2006-0507","urls":{"html":"https://cve.report/CVE-2006-0507","api":"https://cve.report/api/cve/CVE-2006-0507.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-0507","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-0507"},"summary":{"title":"CVE-2006-0507","description":"Multiple cross-site scripting (XSS) vulnerabilities in Easy CMS allow remote attackers to inject arbitrary web script or HTML via (1) unknown attack vectors in the administrative interface and (2) input fields of the contact form.","state":"PUBLISHED","assigner":"mitre","published_at":"2006-02-01 23:02:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/archive/1/423563/100/0/threaded","name":"http://www.securityfocus.com/archive/1/423563/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/16430","name":"http://www.securityfocus.com/bid/16430","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"EasyCMS Multiple Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24371","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24371","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/424431/100/0/threaded","name":"http://www.securityfocus.com/archive/1/424431/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/423442/100/0/threaded","name":"http://www.securityfocus.com/archive/1/423442/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/0385","name":"http://www.vupen.com/english/advisories/2006/0385","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/18673","name":"http://secunia.com/advisories/18673","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Secunia - Advisories - Easy CMS Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-0507","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-0507","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"507","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"easy_cms","cpe5":"easy_cms","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2006","cve_id":"507","cve":"CVE-2006-0507","epss":"0.005270000","percentile":"0.671470000","score_date":"2026-04-16","updated_at":"2026-04-17 00:09:25"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T16:41:27.624Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20060129 EasyCMS vulnerable to XSS injection.","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/423442/100/0/threaded"},{"name":"ADV-2006-0385","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2006/0385"},{"name":"20060208 Re: Re: EasyCMS vulnerable to XSS injection.","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/424431/100/0/threaded"},{"name":"16430","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/16430"},{"name":"20060131 Re: EasyCMS vulnerable to XSS injection.","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/423563/100/0/threaded"},{"name":"18673","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/18673"},{"name":"easycms-xss(24371)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24371"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-01-29T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in Easy CMS allow remote attackers to inject arbitrary web script or HTML via (1) unknown attack vectors in the administrative interface and (2) input fields of the contact form."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-19T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20060129 EasyCMS vulnerable to XSS injection.","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/423442/100/0/threaded"},{"name":"ADV-2006-0385","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2006/0385"},{"name":"20060208 Re: Re: EasyCMS vulnerable to XSS injection.","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/424431/100/0/threaded"},{"name":"16430","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/16430"},{"name":"20060131 Re: EasyCMS vulnerable to XSS injection.","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/423563/100/0/threaded"},{"name":"18673","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/18673"},{"name":"easycms-xss(24371)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24371"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-0507","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in Easy CMS allow remote attackers to inject arbitrary web script or HTML via (1) unknown attack vectors in the administrative interface and (2) input fields of the contact form."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20060129 EasyCMS vulnerable to XSS injection.","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/423442/100/0/threaded"},{"name":"ADV-2006-0385","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/0385"},{"name":"20060208 Re: Re: EasyCMS vulnerable to XSS injection.","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/424431/100/0/threaded"},{"name":"16430","refsource":"BID","url":"http://www.securityfocus.com/bid/16430"},{"name":"20060131 Re: EasyCMS vulnerable to XSS injection.","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/423563/100/0/threaded"},{"name":"18673","refsource":"SECUNIA","url":"http://secunia.com/advisories/18673"},{"name":"easycms-xss(24371)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24371"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-0507","datePublished":"2006-02-01T23:00:00.000Z","dateReserved":"2006-02-01T00:00:00.000Z","dateUpdated":"2024-08-07T16:41:27.624Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-02-01 23:02:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:easy_cms:easy_cms:*:*:*:*:*:*:*:*","matchCriteriaId":"5758AC8E-75D6-4369-92D4-3E2EDFE78E8B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"507","Ordinal":"1","Title":"CVE-2006-0507","CVE":"CVE-2006-0507","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"507","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in Easy CMS allow remote attackers to inject arbitrary web script or HTML via (1) unknown attack vectors in the administrative interface and (2) input fields of the contact form.","Type":"Description","Title":"CVE-2006-0507"},{"CveYear":"2006","CveId":"507","Ordinal":"2","NoteData":"2006-02-01","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"507","Ordinal":"3","NoteData":"2018-10-19","Type":"Other","Title":"Modified"}]}}}