$ cve CVE-2006-5770 JSON

CVE-2006-5770 EXPLOIT

6.8

MEDIUM · CVSS 2.0 · EPSS 2.8% (pctl 86)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in ac4p Mobile allow remote attackers to inject arbitrary web script or HTML via (1) Bloks, (2) Newnews, (3) lBlok, and (4) foooot parameter in (a) index.php; Newnews, (5) newmsgs, and Bloks parameter in (b) MobileNews.php; Newnews parameter in (c) polls.php; (6) cats parameter in (d) send.php; (7) footer parameter in (e) up.php; and (8) pagenav parameter in (f) cp/index.php.

Scoring

CVSS	6.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS	2.78% — more likely to be exploited than 86% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-11-06
Last modified	2026-06-16

Affected (1)

Vendor	Product
ac4p	ac4p mobile

Public exploits

Source	Title	Date
exploit-db	ac4p Mobile - 'index.php' Multiple Cross-Site Scripting Vulnerabilities	2006-11-03
exploit-db	ac4p Mobile - 'MobileNews.php' Multiple Cross-Site Scripting Vulnerabilities	2006-11-03
exploit-db	ac4p Mobile - 'polls.php' Multiple Cross-Site Scripting Vulnerabilities (1)	2006-11-03
exploit-db	ac4p Mobile - 'send.php?cats' Cross-Site Scripting	2006-11-03
exploit-db	ac4p Mobile - 'up.php' Multiple Cross-Site Scripting Vulnerabilities	2006-11-03
exploit-db	ac4p Mobile - '/cp/index.php?pagenav' Cross-Site Scripting	2006-11-03

References

→ the Explorer · watch your stack · NVD