CVE-2006-1033 EXPLOIT
Patch early
A public exploit exists.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arbitrary web script or HTML via (1) uname, (2) error, (3) profile or (4) the username filed parameter to the (a) Your_Account module, (5) catid, (6) sid, (7) Story Text or (8) Extended text text fields in the (b) News module, (9) month, (10) year or (11) sa parameter to the (c) Stories_Archive module, (12) show, (13) cid, (14) ratetype, or (15) orderby parameter to the (d) Web_Links module, (16) op, or (17) pollid parameter to the (e) Surveys module, (18) c parameter to the (f) Downloads module, (19) meta, or (20) album parameter to the (g) coppermine module, or the search box in the (21) Search, (22) Stories_Archive, (23) Downloads, and (24) Topics module.
Scoring
| CVSS | 4.3 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| EPSS | 1.95% — more likely to be exploited than 80% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2006-03-07 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| cpg-nuke | dragonfly cms |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Dragonfly CMS 9.0.6 1 Your_Account Module - Multiple Cross-Site Scripting Vulnerabilities | 2006-02-22 |
| exploit-db | Dragonfly CMS 9.0.6 1 News Module - Multiple Cross-Site Scripting Vulnerabilities | 2006-02-22 |
| exploit-db | Dragonfly CMS 9.0.6.1 Stories_Archive Module - Multiple Cross-Site Scripting Vulnerabilities | 2006-02-22 |
| exploit-db | Dragonfly CMS 9.0.6.1 Web_Links Module - Multiple Cross-Site Scripting Vulnerabilities | 2006-02-22 |
| exploit-db | Dragonfly CMS 9.0.6.1 Surveys Module - Multiple Cross-Site Scripting Vulnerabilities | 2006-02-22 |
| exploit-db | Dragonfly CMS 9.0.6.1 Downloads Module - 'c' Cross-Site Scripting | 2006-02-22 |
| exploit-db | Dragonfly CMS 9.0.6.1 Coppermine Module - 'album' Cross-Site Scripting | 2006-02-22 |
References
- http://lostmon.blogspot.com/2006/02/multiple-cross-site-scripting-in.html
- http://secunia.com/advisories/18940
- http://securitytracker.com/id?1015661
- http://www.securityfocus.com/bid/16784
- http://www.vupen.com/english/advisories/2006/0688
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24843
- http://lostmon.blogspot.com/2006/02/multiple-cross-site-scripting-in.html
- http://secunia.com/advisories/18940
- http://securitytracker.com/id?1015661
- http://www.securityfocus.com/bid/16784
- http://www.vupen.com/english/advisories/2006/0688
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24843
→ the Explorer · watch your stack · NVD