medium6.8Public exploit code
CVE-2006-6808
Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the fi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Core 1.x/2.0.x - 'template.php' HTML Injection2006-12-27 · webapps · php · Verified
Impact
Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the get_file_description function in wp-admin/admin-functions.php.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wordpress | Wordpress | through 2.0.5 Versions 0.6.2, 0.6.2.1, 0.7, 0.71, 1.2 |
References
- NVD record
- CVE.org record
- http://marc.info/?l=full-disclosure&m=116722128631087&w=2
- http://michaeldaw.org/
- http://secunia.com/advisories/23587
- http://secunia.com/advisories/23741
- http://security.gentoo.org/glsa/glsa-200701-10.xml
- http://trac.wordpress.org/changeset/4665
- http://www.securityfocus.com/bid/21782
- http://www.vupen.com/english/advisories/2006/5191
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31133
- http://marc.info/?l=full-disclosure&m=116722128631087&w=2
- http://michaeldaw.org/
- http://secunia.com/advisories/23587
- http://secunia.com/advisories/23741
- http://security.gentoo.org/glsa/glsa-200701-10.xml
- http://trac.wordpress.org/changeset/4665
- http://www.securityfocus.com/bid/21782
- http://www.vupen.com/english/advisories/2006/5191
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31133