CVE-2006-7195
Apache Tomcat XSS Vulnerability
4.3 MediumFix available
Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
Exploit likelihood
5.48%Down 0.9 points since Feb 4, 2022
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
- Record
CVE-2006-7195- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
- Record
CVE-2006-7195- Updated
- 2026-11-02
EUVDEUVD-2022-4681 No score
Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
- Record
EUVD-2022-4681- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p57v-p3fx-qgwm No score
Apache Tomcat XSS Vulnerability
Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
- Record
GHSA-p57v-p3fx-qgwm- Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSVGHSA-p57v-p3fx-qgwm No score
Apache Tomcat XSS Vulnerability
Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
- Record
GHSA-p57v-p3fx-qgwm- Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
5.0.0 to 5.0.30 | None known |
org.apache.tomcat:tomcatMaven |
5.5.0 to 5.5.17 | 5.5.18 |
org.apache.tomcat:tomcatMaven |
5.5.0 up to 5.5.18 | 5.5.18 |
jakarta-commons-modelerRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:2.0-3jpp_2rh | 0:2.0-3jpp_2rh |
jakarta-commons-modeler-javadocRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:2.0-3jpp_2rh | 0:2.0-3jpp_2rh |
tomcat5Red Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-admin-webappsRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-common-libRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-jasperRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-jasper-javadocRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
Show 84 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat5-jsp-2.0-apiRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-jsp-2.0-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-server-libRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-servlet-2.4-apiRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-servlet-2.4-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-webappsRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
jakarta-commons-modelerRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:1.1-8jpp.1.0.2.el5 | 0:1.1-8jpp.1.0.2.el5 |
jakarta-commons-modeler-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:1.1-8jpp.1.0.2.el5 | 0:1.1-8jpp.1.0.2.el5 |
jakarta-commons-modeler-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:1.1-8jpp.1.0.2.el5 | 0:1.1-8jpp.1.0.2.el5 |
tomcat5Red Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-common-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jasperRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-server-libRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-webappsRed Hat:enterprise_linux:5::client_workstation From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5Red Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::client From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
jakarta-commons-modelerRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:1.1-8jpp.1.0.2.el5 | 0:1.1-8jpp.1.0.2.el5 |
jakarta-commons-modeler-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:1.1-8jpp.1.0.2.el5 | 0:1.1-8jpp.1.0.2.el5 |
jakarta-commons-modeler-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:1.1-8jpp.1.0.2.el5 | 0:1.1-8jpp.1.0.2.el5 |
tomcat5Red Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-admin-webappsRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-common-libRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jasperRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jasper-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jsp-2.0-apiRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-jsp-2.0-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-server-libRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-servlet-2.4-apiRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-servlet-2.4-api-javadocRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
tomcat5-webappsRed Hat:enterprise_linux:5::server From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp.1.0.3.el5 | 0:5.5.23-0jpp.1.0.3.el5 |
jakarta-commons-modelerRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:2.0-3jpp_3rh | 0:2.0-3jpp_3rh |
tomcat5Red Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_6rh | 0:5.5.23-0jpp_6rh |
tomcat5-common-libRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_6rh | 0:5.5.23-0jpp_6rh |
tomcat5-jasperRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_6rh | 0:5.5.23-0jpp_6rh |
tomcat5-jsp-2.0-apiRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_6rh | 0:5.5.23-0jpp_6rh |
tomcat5-server-libRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_6rh | 0:5.5.23-0jpp_6rh |
tomcat5-servlet-2.4-apiRed Hat:rhel_developer_suite:3 From an advisory covering 4 CVEs |
before 0:5.5.23-0jpp_6rh | 0:5.5.23-0jpp_6rh |
tomcat5Red Hat:rhel_application_server:1 From an advisory covering 8 CVEs |
before 0:5.0.30-0jpp_5rh | 0:5.0.30-0jpp_5rh |
tomcat5-admin-webappsRed Hat:rhel_application_server:1 From an advisory covering 8 CVEs |
before 0:5.0.30-0jpp_5rh | 0:5.0.30-0jpp_5rh |
tomcat5-webappsRed Hat:rhel_application_server:1 From an advisory covering 8 CVEs |
before 0:5.0.30-0jpp_5rh | 0:5.0.30-0jpp_5rh |
jabberdRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.0s10-3.37.rhn | 0:2.0s10-3.37.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
jfreechartRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.24-1.el3 | 0:2.24-1.el3 |
rhn-apacheRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.3.27-36.rhn.rhel3 | 0:1.3.27-36.rhn.rhel3 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.2.23-2rhn.rhel3 | 0:1.2.23-2rhn.rhel3 |
rhn-modperlRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.29-16.rhel3 | 0:1.29-16.rhel3 |
rhn-modsslRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.8.12-8.rhn.10.rhel3 | 0:2.8.12-8.rhn.10.rhel3 |
tomcat5Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-7195 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published May 9, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.48%, the 92nd percentile. Fixed in org.apache.tomcat:tomcat 5.5.18.
References
lists.vmware.com/pipermail/security-announce/2008/000003.html
securityfocus.com/bid/28481
vupen.com/english/advisories/2008/0065
secunia.com/advisories/33668
Show 193 moreShow less
support.avaya.com/elmodocs2/security/ASA-2007-206.htm
redhat.com/support/errata/RHSA-2007-0327.html
tomcat.apache.org/security-5.html
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10514
community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
nvd.nist.gov/vuln/detail/CVE-2006-7195
access.redhat.com/errata/RHSA-2007:0326
bugzilla.redhat.com/show_bug.cgi?id=237081
web.archive.org/web/20080515114843/http://www.securityfocus.com/bid/28481
github.com/advisories/GHSA-p57v-p3fx-qgwm
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0326.json
cve.org/CVERecord?id=CVE-2005-2090