CVE-2006-4973

DotNetNuke <3.3.5-4.3.5 - XSS

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in Default.aspx in Perpetual Motion Interactive Systems DotNetNuke before 3.3.5, and 4.x before 4.3.5, allows remote attackers to inject arbitrary HTML via the error parameter.

Exploits (1)

exploitdb WORKING POC VERIFIED
by Secure Shapes · textwebappsasp
https://www.exploit-db.com/exploits/28615

References (6)

Core 6
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/22051
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2006/3734
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/29048
Exploit, Patch, Vendor Advisory, URL Repurposed x_refsource_misc
http://www.secureshapes.com/advisories/vuln20-09-2006.htm
Exploit vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/20117

Scores

EPSS 0.0108
EPSS Percentile 78.1%

Details

Status published
Products (12)
dotnetnuke/dotnetnuke 1.0.6
dotnetnuke/dotnetnuke 1.0.7
dotnetnuke/dotnetnuke 1.0.8
dotnetnuke/dotnetnuke 1.0.9
dotnetnuke/dotnetnuke 1.0.10d
dotnetnuke/dotnetnuke 1.0.10e
dotnetnuke/dotnetnuke 2.1.1
dotnetnuke/dotnetnuke 2.1.2
dotnetnuke/dotnetnuke 3.0.7
dotnetnuke/dotnetnuke 3.0.8
... and 2 more
Published Sep 25, 2006
Tracked Since Feb 18, 2026