CVE-2006-1590

published 2006-04-03

CVE-2006-1590: Cross-site scripting (XSS) vulnerability in the PrintFreshPage function in (1) Basic Analysis and Security Engine (BASE) 1.2.4 and (2) Analysis Console for…

Priority P4 20 medium 4.3 CVSS 2.0

AV N AC M Au N C N I P A N

EXPLOIT

Cross-site scripting (XSS) vulnerability in the PrintFreshPage function in (1) Basic Analysis and Security Engine (BASE) 1.2.4 and (2) Analysis Console for Intrusion Databases (ACID) 0.9.6b23 allows remote attackers to inject arbitrary web script or HTML via the (a) back parameter to base_graph_main.php, (b) netmask parameter to base_stat_ipaddr.php, or (c) submit parameter to base_qry_alert.php within BASE, or (d) query string to acid_main.php in ACID, which causes the request URI ($_SERVER['REQUEST_URI']) to be inserted into a refresh operation.

Affected

16 ranges

Vendor	Product	Version range	Fixed in
kevin_johnson	basic_analysis_and_security_engine	—	—
kevin_johnson	basic_analysis_and_security_engine	—	—
kevin_johnson	basic_analysis_and_security_engine	—	—
kevin_johnson	basic_analysis_and_security_engine	—	—
kevin_johnson	basic_analysis_and_security_engine	—	—
kevin_johnson	basic_analysis_and_security_engine	—	—
kevin_johnson	basic_analysis_and_security_engine	—	—
kevin_johnson	basic_analysis_and_security_engine	—	—
kevin_johnson	basic_analysis_and_security_engine	—	—
kevin_johnson	basic_analysis_and_security_engine	—	—
kevin_johnson	basic_analysis_and_security_engine	—	—
kevin_johnson	basic_analysis_and_security_engine	—	—
kevin_johnson	basic_analysis_and_security_engine	—	—
kevin_johnson	basic_analysis_and_security_engine	—	—
kevin_johnson	basic_analysis_and_security_engine	—	—
roman_danyliw	analysis_console_for_intrusion_databases	—	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.