PT-2006-1977 · Webinsta · Webinsta Limbo

Published 2006-02-28 · Updated 2017-07-20 · CVE-2006-0934

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions webinsta Limbo version 1.0.4.2

Description The issue allows remote attackers to inject arbitrary web script or HTML via the message field in the "Contact Form" API endpoint. This can lead to cross-site scripting (XSS) attacks.

Recommendations For webinsta Limbo version 1.0.4.2, consider disabling the Contact Form until a patch is available to prevent exploitation. Restrict access to the message field in the Contact Form to minimize the risk of XSS attacks.

Fix

Related Identifiers

CVE-2006-0934

Affected Products

Webinsta Limbo

References · 7

• http://secunia.com/advisories/18723 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-0934 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24877 · Note
• http://osvdb.org/23469 · Note
• http://osvdb.org/ref/23/23469-limbo.txt · Note
• http://securityfocus.com/bid/16811 · Note
• http://vupen.com/english/advisories/2006/0721 · Note