CVE-2006-0800

Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross...

2.6 LowPublic exploit

Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character, which is interpreted as a ">" character by some web browsers but bypasses the blacklist protection in (1) the pnVarCleanFromInput function in pnAPI.php, (2) the pnSecureInput function in pnAntiCracker.php, and (3) the htmltext parameter in an edituser operation to user.php.

Exploit likelihood

2.18%Down 0.8 points since Feb 4, 2022

What each source reports

NVD Score used 2.6

Record: CVE-2006-0800
CVSS 2.0: 2.6 LowAV:N/AC:H/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2006-0800
Updated: 2026-11-02

EUVDEUVD-2006-0806 No score

Record: EUVD-2006-0806
Updated: 2026-11-03

GitHub AdvisoriesGHSA-79gg-fg79-5cf7 No score

Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross...

Record: GHSA-79gg-fg79-5cf7
Weakness: CWE-79
Updated: 2026-11-02

Affected products

postnuke software foundation postnuke

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	PostNuke 0.6x/0.7x NS-Languages Module - 'language' Cross-Site Scripting	2006-02-21

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-0800 is a low vulnerability (CVSS 2.6) in Postnuke Software Foundation Postnuke, published February 20, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.18%, the 82nd percentile. No source names a fixed version.