CVE-2006-4712 - Multiple cross-site scripting (XSS) vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read arbitrary local files, aka "Cross Context Scripting."

Back Back to CVE browser

MEDIUM

Multiple cross-site scripting (XSS) vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read arbitrary local files, aka "Cross Context Scripting."

Published Sep 12, 2006

6.8

MEDIUM

CVSS 2.0

EPSS 2.20%

Description

Multiple cross-site scripting (XSS) vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read arbitrary local files, aka "Cross Context Scripting."

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (11)

http://downloads.securityfocus.com/vulnerabilities/exploits/sage-inputvalidation.xml
x_refsource_MISCExploit
http://secunia.com/advisories/21839
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://securityreason.com/securityalert/1558
third-party-advisoryx_refsource_SREASON
http://www.gnucitizen.org/blog/cross-context-scripting-with-sage
x_refsource_MISC
http://www.intertwingly.net/blog/2006/08/09/Attack-Delivery-TestSuite
x_refsource_MISC
http://www.securityfocus.com/archive/1/445648/100/0/threaded
mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/19928
vdb-entryx_refsource_BIDExploit
http://www.snellspace.com/wp/?p=410
x_refsource_MISC
http://www.snellspace.com/wp/?p=448
x_refsource_MISC
http://www.vupen.com/english/advisories/2006/3553
vdb-entryx_refsource_VUPENVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/28855
vdb-entryx_refsource_XF

Link	Providers	Tags
http://downloads.securityfocus.com/vulnerabilities/exploits/sage-inputvalidation.xml		x_refsource_MISCExploit
http://secunia.com/advisories/21839		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://securityreason.com/securityalert/1558		third-party-advisoryx_refsource_SREASON
http://www.gnucitizen.org/blog/cross-context-scripting-with-sage		x_refsource_MISC
http://www.intertwingly.net/blog/2006/08/09/Attack-Delivery-TestSuite		x_refsource_MISC
http://www.securityfocus.com/archive/1/445648/100/0/threaded		mailing-listx_refsource_BUGTRAQ
http://www.securityfocus.com/bid/19928		vdb-entryx_refsource_BIDExploit
http://www.snellspace.com/wp/?p=410		x_refsource_MISC
http://www.snellspace.com/wp/?p=448		x_refsource_MISC
http://www.vupen.com/english/advisories/2006/3553		vdb-entryx_refsource_VUPENVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/28855		vdb-entryx_refsource_XF

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Sep 12, 2006

Updated Aug 7, 2024

Reserved Sep 12, 2006

Link CVE-2006-4712

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2006-4712

Red Hat

Severity n/a

Public date n/a

Links CVE-2006-4712