CVE-2006-0800 describes a cross-site scripting (XSS) vulnerability in PostNuke 0.761 and earlier versions. This flaw arises from an interpretation conflict where certain web browsers treat a trailing "<" character in HTML tags as a ">", bypassing PostNuke's blacklist protections in functions like pnVarCleanFromInput and pnSecureInput, as well as the htmltext parameter in user.php. The vulnerability has a low CVSS score of 2.6, indicating a network-based attack with high access complexity and a partial impact on integrity, but no impact on confidentiality or availability. Its EPSS score is low, suggesting a low probability of exploitation. While there is no evidence of active exploitation or Metasploit/Nuclei modules, an exploit for PostNuke 0.6x/0.7x NS-Languages Module has been published on ExploitDB. Community discussion and media coverage for this CVE are minimal, consistent with the majority of older vulnerabilities.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.7CPE matchmatch criteria | cpe:2.3:a:postnuke_software_foundation:postnuke:0.7:*:*:*:*:*:*:* | ||
0.62CPE matchmatch criteria | cpe:2.3:a:postnuke_software_foundation:postnuke:0.62:*:*:*:*:*:*:* | ||
0.63CPE matchmatch criteria | cpe:2.3:a:postnuke_software_foundation:postnuke:0.63:*:*:*:*:*:*:* | ||
0.64CPE matchmatch criteria | cpe:2.3:a:postnuke_software_foundation:postnuke:0.64:*:*:*:*:*:*:* | ||
0.70CPE matchmatch criteria | cpe:2.3:a:postnuke_software_foundation:postnuke:0.70:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:H/Au:N/C:N/I:P/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.