$ cve CVE-2006-2894 JSON

CVE-2006-2894 EXPLOIT

4.0

MEDIUM · CVSS 2.0 · EPSS 9.8% (pctl 95)

Patch early

A public exploit exists.

Description

Mozilla Firefox 1.5.0.4, 2.0.x before 2.0.0.8, Mozilla Suite 1.7.13, Mozilla SeaMonkey 1.0.2 and other versions before 1.1.5, and Netscape 8.1 and earlier allow user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the OnKeyDown, OnKeyPress, and OnKeyUp Javascript keystroke events to change the focus and cause those characters to be inserted into a file upload input control, which can then upload the file when the user submits the form.

Scoring

CVSS	4.0 (MEDIUM, v2.0)
Vector	AV:N/AC:H/Au:N/C:P/I:P/A:N
EPSS	9.83% — more likely to be exploited than 95% of all CVEs
Weakness	CWE-20
On CISA KEV	no
Public exploit	yes
Published	2006-06-07
Last modified	2026-06-16

Affected (4)

Vendor	Product
mozilla	firefox
mozilla	mozilla suite
mozilla	seamonkey
netscape	navigator

Public exploits

Source	Title	Date
exploit-db	Microsoft Internet Explorer 5.5/6.0/7.0 - JavaScript Key Filtering	2006-06-06
exploit-db	Mozilla Firefox 1.x - JavaScript Key Filtering	2006-06-06

References

→ the Explorer · watch your stack · NVD