{"api_version":"1","generated_at":"2026-07-23T05:45:24+00:00","cve":"CVE-2006-6089","urls":{"html":"https://cve.report/CVE-2006-6089","api":"https://cve.report/api/cve/CVE-2006-6089.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-6089","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-6089"},"summary":{"title":"CVE-2006-6089","description":"Multiple cross-site scripting (XSS) vulnerabilities in addpost1.asp in BaalAsp forum allow remote attackers to inject arbitrary web script or HTML via the (1) title (Subject), (2) groupname (Group Name), or (3) detail (Message) field.","state":"PUBLISHED","assigner":"mitre","published_at":"2006-11-24 18:07:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.vupen.com/english/advisories/2006/4579","name":"http://www.vupen.com/english/advisories/2006/4579","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/21111","name":"http://www.securityfocus.com/bid/21111","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"BaalAsp Forum Multiple Input Validation Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securityfocus.com/archive/1/451846/100/100/threaded","name":"http://www.securityfocus.com/archive/1/451846/100/100/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/1913","name":"http://securityreason.com/securityalert/1913","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CXSecurity - IDS","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/22943","name":"http://secunia.com/advisories/22943","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"BaalASP Smart Form Portal Software Multiple Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://s-a-p.ca/index.php?page=OurAdvisories&id=35","name":"http://s-a-p.ca/index.php?page=OurAdvisories&id=35","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory","URL Repurposed"],"title":"s-a-p.ca","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30344","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30344","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-6089","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-6089","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"6089","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"baalasp","cpe5":"baalasp_forum","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T20:12:31.651Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"21111","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/21111"},{"name":"20061115 BaalAsp forum [login bypass ,injections sql(post), xss(post)]","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/451846/100/100/threaded"},{"name":"22943","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/22943"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://s-a-p.ca/index.php?page=OurAdvisories&id=35"},{"name":"1913","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/1913"},{"name":"baalasp-addpost1-xss(30344)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30344"},{"name":"ADV-2006-4579","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2006/4579"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-11-15T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in addpost1.asp in BaalAsp forum allow remote attackers to inject arbitrary web script or HTML via the (1) title (Subject), (2) groupname (Group Name), or (3) detail (Message) field."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-17T20:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"21111","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/21111"},{"name":"20061115 BaalAsp forum [login bypass ,injections sql(post), xss(post)]","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/451846/100/100/threaded"},{"name":"22943","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/22943"},{"tags":["x_refsource_MISC"],"url":"http://s-a-p.ca/index.php?page=OurAdvisories&id=35"},{"name":"1913","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/1913"},{"name":"baalasp-addpost1-xss(30344)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30344"},{"name":"ADV-2006-4579","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2006/4579"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-6089","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in addpost1.asp in BaalAsp forum allow remote attackers to inject arbitrary web script or HTML via the (1) title (Subject), (2) groupname (Group Name), or (3) detail (Message) field."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"21111","refsource":"BID","url":"http://www.securityfocus.com/bid/21111"},{"name":"20061115 BaalAsp forum [login bypass ,injections sql(post), xss(post)]","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/451846/100/100/threaded"},{"name":"22943","refsource":"SECUNIA","url":"http://secunia.com/advisories/22943"},{"name":"http://s-a-p.ca/index.php?page=OurAdvisories&id=35","refsource":"MISC","url":"http://s-a-p.ca/index.php?page=OurAdvisories&id=35"},{"name":"1913","refsource":"SREASON","url":"http://securityreason.com/securityalert/1913"},{"name":"baalasp-addpost1-xss(30344)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30344"},{"name":"ADV-2006-4579","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/4579"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-6089","datePublished":"2006-11-24T18:00:00.000Z","dateReserved":"2006-11-24T00:00:00.000Z","dateUpdated":"2024-08-07T20:12:31.651Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-11-24 18:07:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:baalasp:baalasp_forum:*:*:*:*:*:*:*:*","matchCriteriaId":"F28786F1-60A1-4AA8-A5B6-2A9EB9652F77"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"6089","Ordinal":"1","Title":"CVE-2006-6089","CVE":"CVE-2006-6089","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"6089","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in addpost1.asp in BaalAsp forum allow remote attackers to inject arbitrary web script or HTML via the (1) title (Subject), (2) groupname (Group Name), or (3) detail (Message) field.","Type":"Description","Title":"CVE-2006-6089"},{"CveYear":"2006","CveId":"6089","Ordinal":"2","NoteData":"2006-11-24","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"6089","Ordinal":"3","NoteData":"2018-10-17","Type":"Other","Title":"Modified"}]}}}