CVE-2006-2084

Farsinews < 2.5.3_pro - XSS

Title source: rule

Description

Multiple cross-site scripting (XSS) vulnerabilities in FarsiNews 2.5.3 Pro and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) month and (2) year parameters in (a) index.php, and the (3) mod parameter in (b) admin.php.

References (5)

[Exploit] http://www.aria-security.net/advisory/farsinews/farsinews0420062.txt

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/26097

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/432109/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/17701

[Third Party Advisory] http://securityreason.com/securityalert/812

Scores

EPSS 0.0050

EPSS Percentile 65.8%

Classification

CWE

CWE-79

Status draft

Affected Products (4)

farsinews/farsinews < 2.5.3_pro

farsinews/farsinews

farsinews/farsinews

farsinews/farsinews

Timeline

Published Apr 29, 2006

Tracked Since Feb 18, 2026