Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2006-2016 — Cross-site Scripting in Phpldapadmin

CWE-79 — Cross-site ScriptingCWE-416 — Use After Free13 documents7 sources
Severity
2.6LOWNVD
EPSS
22.0%
top 4.21%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Phpldapadmin Project PhpldapadminDebian PhpldapadminDebian Linux
Timeline
PublishedApr 25
Latest updateMay 1

Description

Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dn parameter in (a) compare_form.php, (b) copy_form.php, (c) rename_form.php, (d) template_engine.php, and (e) delete_form.php; (2) scope parameter in (f) search.php; and (3) Container DN, (4) Machine Name, and (5) UID Number fields in (g) template_engine.php.

CVSS vector

AV:N/AC:H/C:N/I:P/A:NExploitability: 4.9 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/phpldapadmin< phpldapadmin 0.9.8.3-1 (bookworm)
▶Debianphpldapadmin_project/phpldapadmin< 0.9.8.3-1+2

Also affects: Debian Linux 3.0, 3.1

🔴Vulnerability Details

2
GHSA
GHSA-r8w9-95fc-rxgp: Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0↗2022-05-01
▶
OSV
CVE-2006-2016: Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0↗2006-04-25
▶

💥Exploits & PoCs

7
Exploit-DB
KarjaSoft Sami FTP Server 2.0.2 - USER/PASS Remote Buffer Overflow (SEH)↗2016-11-01
▶
Exploit-DB
CesarFTP 0.99g - XCWD Denial of Service↗2016-01-19
▶
Exploit-DB
phpLDAPadmin 0.9.8 - 'rename_form.php' Cross-Site Scripting↗2006-04-21
▶
Exploit-DB
phpLDAPadmin 0.9.8 - 'search.php' Cross-Site Scripting↗2006-04-21
▶
Exploit-DB
phpLDAPadmin 0.9.8 - 'copy_form.php' Cross-Site Scripting↗2006-04-21
▶

📋Vendor Advisories

2
Red Hat
perl-DBD-MySQL: Use after free when using prepared statements↗2016-11-18
▶
Debian
CVE-2006-2016: phpldapadmin - Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and ea...↗2006
▶

💬Community

1
Bugzilla
CVE-2016-1249 perl-DBD-MySQL: Out-of-bounds read when using server-side prepared statement support↗2016-11-16
▶