CVE-2006-7196
Cross-site scripting in Apache Tomcat
4.3 MediumPublic exploitFix available
Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.
Exploit likelihood
72.2%Up 23.2 points since Feb 4, 2022
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.
- Record
CVE-2006-7196- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.
- Record
CVE-2006-7196- Updated
- 2026-11-02
EUVDEUVD-2022-4794 No score
Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.
- Record
EUVD-2022-4794- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pm78-wxxf-fw98 No score
Cross-site scripting in Apache Tomcat
Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.
- Record
GHSA-pm78-wxxf-fw98- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-pm78-wxxf-fw98 No score
Cross-site scripting in Apache Tomcat
Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.
- Record
GHSA-pm78-wxxf-fw98- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.tomcat:tomcatMaven |
4.0.0 up to 4.0.7 | 4.0.7 |
org.apache.tomcat:tomcatMaven |
4.1.0 up to 4.1.32 | 4.1.32 |
org.apache.tomcat:tomcatMaven |
5.0.0 up to 5.0.31 | 5.0.31 |
org.apache.tomcat:tomcatMaven |
5.5.0 up to 5.5.16 | 5.5.16 |
jakarta-commons-modelerRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:2.0-3jpp_2rh | 0:2.0-3jpp_2rh |
jakarta-commons-modeler-javadocRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:2.0-3jpp_2rh | 0:2.0-3jpp_2rh |
tomcat5Red Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-admin-webappsRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-common-libRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-jasperRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
Show 46 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tomcat5-jasper-javadocRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-jsp-2.0-apiRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-jsp-2.0-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-server-libRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-servlet-2.4-apiRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-servlet-2.4-api-javadocRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5-webappsRed Hat:rhel_application_server:2 From an advisory covering 7 CVEs |
before 0:5.5.23-0jpp_4rh.3 | 0:5.5.23-0jpp_4rh.3 |
tomcat5Red Hat:rhel_application_server:1 From an advisory covering 8 CVEs |
before 0:5.0.30-0jpp_5rh | 0:5.0.30-0jpp_5rh |
tomcat5-admin-webappsRed Hat:rhel_application_server:1 From an advisory covering 8 CVEs |
before 0:5.0.30-0jpp_5rh | 0:5.0.30-0jpp_5rh |
tomcat5-webappsRed Hat:rhel_application_server:1 From an advisory covering 8 CVEs |
before 0:5.0.30-0jpp_5rh | 0:5.0.30-0jpp_5rh |
jabberdRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:5.0:el4 From an advisory covering 35 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.0s10-3.37.rhn | 0:2.0s10-3.37.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el3 | 0:1.4.2.10-1jpp.2.el3 |
jfreechartRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.1.30-9.RHEL3.8 | 0:2.1.30-9.RHEL3.8 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.24-1.el3 | 0:2.24-1.el3 |
rhn-apacheRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.3.27-36.rhn.rhel3 | 0:1.3.27-36.rhn.rhel3 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.2.23-2rhn.rhel3 | 0:1.2.23-2rhn.rhel3 |
rhn-modperlRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:1.29-16.rhel3 | 0:1.29-16.rhel3 |
rhn-modsslRed Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:2.8.12-8.rhn.10.rhel3 | 0:2.8.12-8.rhn.10.rhel3 |
tomcat5Red Hat:network_satellite:4.2::el3 From an advisory covering 37 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
jabberdRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.0s10-3.38.rhn | 0:2.0s10-3.38.rhn |
java-1.4.2-ibmRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
java-1.4.2-ibm-develRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.4.2.10-1jpp.2.el4 | 0:1.4.2.10-1jpp.2.el4 |
jfreechartRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:0.9.20-3.rhn | 0:0.9.20-3.rhn |
openmotif21Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
openmotif21-debuginfoRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.1.30-11.RHEL4.6 | 0:2.1.30-11.RHEL4.6 |
perl-Crypt-CBCRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.24-1.el4 | 0:2.24-1.el4 |
rhn-apacheRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.3.27-36.rhn.rhel4 | 0:1.3.27-36.rhn.rhel4 |
rhn-modjk-ap13Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.2.23-2rhn.rhel4 | 0:1.2.23-2rhn.rhel4 |
rhn-modperlRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:1.29-16.rhel4 | 0:1.29-16.rhel4 |
rhn-modsslRed Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:2.8.12-8.rhn.10.rhel4 | 0:2.8.12-8.rhn.10.rhel4 |
tomcat5Red Hat:network_satellite:4.2::el4 From an advisory covering 37 CVEs |
before 0:5.0.30-0jpp_10rh | 0:5.0.30-0jpp_10rh |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Apache Tomcat 5.5.15 - cal2.jsp Cross-Site Scripting | 2007-09-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-7196 is a medium vulnerability (CVSS 4.3) in Apache Tomcat, published May 9, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 72.2%, the 99th percentile. Fixed in org.apache.tomcat:tomcat 4.0.7.
References
tomcat.apache.org/security-4.html
osvdb.org/34888
secunia.com/advisories/29242
securityfocus.com/archive/1/500412/100/0/threaded
lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html
Show 188 moreShow less
vupen.com/english/advisories/2007/1729
support.avaya.com/elmodocs2/security/ASA-2007-206.htm
redhat.com/support/errata/RHSA-2008-0261.html
community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
nvd.nist.gov/vuln/detail/CVE-2006-7196
access.redhat.com/errata/RHSA-2007:0326
bugzilla.redhat.com/show_bug.cgi?id=238131
github.com/advisories/GHSA-pm78-wxxf-fw98
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_0326.json
cve.org/CVERecord?id=CVE-2005-2090