CVE-2006-3533 - CVE House
Back to Database
Status published Medium CVE-2006-3533

Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.30 RC2 and...

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) fg, (2) line1, (3) line2, (4) bg, (5) c1, (6) c2, (7) c3, and (8) c4 parameters in (a) includes/blogroll.php; (9) name and (10) js_name parameters in (b) includes/editor/edit_menu.php; and, even if register_globals is not enabled, the (11) h and (12) w parameters in (c) includes/photo.php.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2006-3533

Credits & Attribution

No credits recorded in the NVD database.

References

More from pivot

View All →
CVE-2009-2134
pivot/tb.php in Pivot 1.40.4 and 1.40.7 allows remote attackers to...
Medium 5
CVE-2009-2133
Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.40.4 and 1.40.7...
Medium 4.3
CVE-2008-3128
Directory traversal vulnerability in search.php in Pivot 1.40.5 allows remote...
Medium 5
CVE-2006-3532
PHP file inclusion vulnerability in includes/edit_new.php in Pivot 1.30 RC2...
Medium 5.1
CVE-2006-3531
includes/editor/insert_image.php in Pivot 1.30 RC2 and earlier creates the authentication...
High 7.5

Affected Vendor

Affected Software

pivot
Vulnerable Versions:
1.30_rc2

Timeline

Official Publish: July 12th, 2006
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.