CVE-2006-4480 - Incomplete blacklist vulnerability in the nk_CSS function in nuked.php in Nuked-Klan 1.7 SP4.3 allows remote attackers to bypass anti-XSS features and inject arbitrary web script or HTML via JavaScript in an attribute value that is not in the blacklist, as demonstrated using the STYLE attribute of a B element

Back Back to CVE browser

MEDIUM

Incomplete blacklist vulnerability in the nk_CSS function in nuked.php in Nuked-Klan 1.7 SP4.3 allows remote attackers to bypass anti-XSS features and inject arbitrary web script or HTML via JavaScript in an attribute value that is not in the blacklist, as demonstrated using the STYLE attribute of a B element

Published Aug 31, 2006

4.3

MEDIUM

CVSS 2.0

EPSS 1.28%

Description

Incomplete blacklist vulnerability in the nk_CSS function in nuked.php in Nuked-Klan 1.7 SP4.3 allows remote attackers to bypass anti-XSS features and inject arbitrary web script or HTML via JavaScript in an attribute value that is not in the blacklist, as demonstrated using the STYLE attribute of a B element.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (2)

http://securityreason.com/securityalert/1478
third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/archive/1/444749/100/0/threaded
mailing-listx_refsource_BUGTRAQ

Link	Providers	Tags
http://securityreason.com/securityalert/1478		third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/archive/1/444749/100/0/threaded		mailing-listx_refsource_BUGTRAQ

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Aug 31, 2006

Updated Aug 7, 2024

Reserved Aug 31, 2006

Link CVE-2006-4480

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2006-4480

Red Hat

Severity n/a

Public date n/a

Links CVE-2006-4480