CVE-2006-2500

MEDIUM 6.8CVE-2006-2500 · Published 20/05/2006 · updated 16/06/2026

In short

CVE-2006-2500 is a MEDIUM (CVSS 6.8) vulnerability affecting codeavalanche news (xfairguy).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 76.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
codeavalanche news xfairguy	`= 1.2`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in add_news.asp in CodeAvalanche News (CANews) 1.2 allows remote attackers to inject arbitrary web script or HTML via the Headline field. NOTE: if this issue is limited to administrators, and if it is expected behavior for administrators to be able to generate HTML, then this is not a vulnerability.

References

colander.altervista.org/advisory/CANews.txt · Exploit
secunia.com/advisories/20171 · Vendor Advisory
osvdb.org/25653
securityfocus.com/archive/1/434730/100/0/threaded
securityfocus.com/bid/18032
vupen.com/english/advisories/2006/1870
exchange.xforce.ibmcloud.com/vulnerabilities/26587

More vulnerabilities in codeavalanche news

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free