CVE-2006-6356

Multiple cross-site scripting (XSS) vulnerabilities in templates/link_temp.php in PHPNews 1.3.0...

6.8 MediumPublic exploit

CVE-2006-6356 is a medium vulnerability (CVSS 6.8) in Phpnews, published December 7, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.98%, the 80th percentile. No source names a fixed version.

Multiple cross-site scripting (XSS) vulnerabilities in templates/link_temp.php in PHPNews 1.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) url, (2) id, (3) subject, (4) username, or (5) time parameter.

Exploit likelihood

1.98%Down 1.0 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2006-6356
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2006-6356
Updated: 2026-11-02

EUVDEUVD-2006-6339 No score

Record: EUVD-2006-6339
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g4cp-jcg9-qf3p No score

Multiple cross-site scripting (XSS) vulnerabilities in templates/link_temp.php in PHPNews 1.3.0...

Record: GHSA-g4cp-jcg9-qf3p
Updated: 2026-11-02

Affected products

phpnews

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	PHPNews 1.3 - 'Link_Temp.php' Cross-Site Scripting	2006-12-02

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD