CVE-2006-1230

Multiple cross-site scripting (XSS) vulnerabilities in create.php in vCard 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) card_id, (2) uploaded, (3) card_fontsize, or (4) card_color parameter. NOTE: the card_id vector was later reported to affect vCard 2.9, and the uploaded vector for 2.6.

• CWE-79

• http://secunia.com/advisories/19216Vendor Advisory
• http://securitytracker.com/id?1016183
• http://www.osvdb.org/23838
• http://www.securityfocus.com/archive/1/427408/100/0/threaded
• http://www.securityfocus.com/archive/1/435310/100/0/threaded
• http://www.securityfocus.com/archive/1/461922/100/0/threaded
• http://www.securityfocus.com/bid/17073Exploit
• http://www.securityfocus.com/bid/22819
• http://www.vupen.com/english/advisories/2006/0945Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25181
• http://secunia.com/advisories/19216Vendor Advisory
• http://securitytracker.com/id?1016183
• http://www.osvdb.org/23838
• http://www.securityfocus.com/archive/1/427408/100/0/threaded
• http://www.securityfocus.com/archive/1/435310/100/0/threaded
• http://www.securityfocus.com/archive/1/461922/100/0/threaded
• http://www.securityfocus.com/bid/17073Exploit
• http://www.securityfocus.com/bid/22819
• http://www.vupen.com/english/advisories/2006/0945Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25181

Published

Mar 14, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-1224Directory traversal vulnerability in dwnld.php in GuppY 4.5.…
• CVE-2006-1225CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 an…
• CVE-2006-1226Cross-site scripting (XSS) vulnerability in Drupal 4.5.x bef…
• CVE-2006-1227Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8, when menu.…
• CVE-2006-1228Session fixation vulnerability in Drupal 4.5.x before 4.5.8 …
• CVE-2006-1229SQL injection vulnerability in search.asp in Hosting Control…
• CVE-2006-1231CAPI4HylaFAX 1.3, when compiled with GENERATE_DEBUGSFFDATAFI…
• CVE-2006-1232Multiple SQL injection vulnerabilities in DSDownload 1.0, wi…
• CVE-2006-1233Multiple cross-site scripting (XSS) vulnerabilities in WMNew…
• CVE-2006-1234SQL injection vulnerability in index.php in DSCounter 1.2, w…
• CVE-2006-1235Directory traversal vulnerability in admin/deleteuser.php in…
• CVE-2006-1236Buffer overflow in the SetUp function in socket/request.c in…