$ cve CVE-2006-1590 JSON

CVE-2006-1590 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 4.1% (pctl 90)

Patch early

A public exploit exists.

Description

Cross-site scripting (XSS) vulnerability in the PrintFreshPage function in (1) Basic Analysis and Security Engine (BASE) 1.2.4 and (2) Analysis Console for Intrusion Databases (ACID) 0.9.6b23 allows remote attackers to inject arbitrary web script or HTML via the (a) back parameter to base_graph_main.php, (b) netmask parameter to base_stat_ipaddr.php, or (c) submit parameter to base_qry_alert.php within BASE, or (d) query string to acid_main.php in ACID, which causes the request URI ($_SERVER['REQUEST_URI']) to be inserted into a refresh operation.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	4.1% — more likely to be exploited than 90% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-04-03
Last modified	2026-06-16

Affected (2)

Vendor	Product
kevin johnson	basic analysis and security engine
roman danyliw	analysis console for intrusion databases $acid$

Public exploits

Source	Title	Date
exploit-db	Basic Analysis and Security Engine (BASE) 1.2.4 - PrintFreshPage Cross-Site Scripting	2003-04-06

References

→ the Explorer · watch your stack · NVD