// For flags

CVE-2006-4712

 

Severity Score

6.1
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Multiple cross-site scripting (XSS) vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read arbitrary local files, aka "Cross Context Scripting."

Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Sage 1.3.6 permite a un atacante remoto inyectar secuencias de comandos web o HTMl de su elección a través de JavaScript en un contenido: elemento codificado dentro de un elemento del artículo en un alimentador RSS, como quedo demostrado por cuatrp ejemplos: elementos codificados que utilizaban XMLHttpRequest para leer archivos locales arbitrarios, también conocidos como “secuencia de comandos de sitios cruzados” .

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2006-09-12 CVE Reserved
  • 2006-09-12 CVE Published
  • 2024-08-07 CVE Updated
  • 2024-08-07 First Exploit
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sage
Search vendor "Sage"
 Sage
Search vendor "Sage" for product "Sage"
 1.3.6
Search vendor "Sage" for product "Sage" and version "1.3.6"
-
Affected