CVE-2006-6925
Multiple cross-site scripting (XSS) vulnerabilities in bitweaver 1.3.1 and earlier allow remote...
CVE-2006-6925 is a medium vulnerability (CVSS 6.8) in Bitweaver, published January 13, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.15%, the 82nd percentile. No source names a fixed version.
- Severity
- 6.8 MediumCVSS 2.0, NVD
- Exploit chance
- 2.15%EPSS, 82nd percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Multiple cross-site scripting (XSS) vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the message title field when submitting an article to articles/edit.php, (2) the message title field when submitting a blog post to blogs/post.php, or (3) the message description field when editing in the Sandbox in wiki/edit.php.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Bitweaver 1.x - '/fisheye/list_galleries.php?sort_mode' SQL Injection | 2006-11-10 |
What each source reports
NVD Score used
Multiple cross-site scripting (XSS) vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the message title field when submitting an article to articles/edit.php, (2) the message title field when submitting a blog post to blogs/post.php, or (3) the message description field when editing in the Sandbox in wiki/edit.php.
- Record
CVE-2006-6925- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Multiple cross-site scripting (XSS) vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the message title field when submitting an article to articles/edit.php, (2) the message title field when submitting a blog post to blogs/post.php, or (3) the message description field when editing in the Sandbox in wiki/edit.php.
- Record
CVE-2006-6925- Updated
- 2026-11-02
EUVDEUVD-2006-6908No score
Multiple cross-site scripting (XSS) vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the message title field when submitting an article to articles/edit.php, (2) the message title field when submitting a blog post to blogs/post.php, or (3) the message description field when editing in the Sandbox in wiki/edit.php.
- Record
EUVD-2006-6908- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rq3w-qmr8-mrc6No score
Multiple cross-site scripting (XSS) vulnerabilities in bitweaver 1.3.1 and earlier allow remote...
Multiple cross-site scripting (XSS) vulnerabilities in bitweaver 1.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the message title field when submitting an article to articles/edit.php, (2) the message title field when submitting a blog post to blogs/post.php, or (3) the message description field when editing in the Sandbox in wiki/edit.php.
- Record
GHSA-rq3w-qmr8-mrc6- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
vupen.com/english/advisories/2006/4485
securityfocus.com/bid/20996
secunia.com/advisories/22793
exchange.xforce.ibmcloud.com/vulnerabilities/30167
archives.neohapsis.com/archives/bugtraq/2006-11/0142.html
securityreason.com/securityalert/2144
nvd.nist.gov/vuln/detail/CVE-2006-6925
github.com/advisories/GHSA-rq3w-qmr8-mrc6