CVE-2006-1595

Cross-site scripting (XSS) vulnerability in document/rqmkhtml.php in Claroline 1.7.4 and earlier allows remote attackers to read arbitrary files via ".." sequences in the file parameter in a rqEditHtml command.

• http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1905.htmlExploit
• http://retrogod.altervista.org/claroline_174_incl_xpl.htmlExploit
• http://secunia.com/advisories/19461Exploit, Vendor Advisory
• http://www.osvdb.org/24284
• http://www.osvdb.org/24285Exploit
• http://www.securityfocus.com/bid/17344Exploit
• http://www.vupen.com/english/advisories/2006/1187
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25562
• https://www.exploit-db.com/exploits/1627
• http://archives.neohapsis.com/archives/fulldisclosure/2006-03/1905.htmlExploit
• http://retrogod.altervista.org/claroline_174_incl_xpl.htmlExploit
• http://secunia.com/advisories/19461Exploit, Vendor Advisory
• http://www.osvdb.org/24284
• http://www.osvdb.org/24285Exploit
• http://www.securityfocus.com/bid/17344Exploit
• http://www.vupen.com/english/advisories/2006/1187
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25562
• https://www.exploit-db.com/exploits/1627

Published

Apr 3, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-1589The elf_load_file function in NetBSD 2.0 through 3.0 allows …
• CVE-2006-1590Cross-site scripting (XSS) vulnerability in the PrintFreshPa…
• CVE-2006-1591Heap-based buffer overflow in Microsoft Windows Help winhlp3…
• CVE-2006-1592Buffer overflow in the is_client_wad_ok function in w_wad.cp…
• CVE-2006-1593The (1) ZD_MissingPlayer, (2) ZD_UseItem, and (3) ZD_LoadNew…
• CVE-2006-1594Multiple directory traversal vulnerabilities in document/rqm…
• CVE-2006-1596PHP remote file inclusion vulnerability in learnPath/include…
• CVE-2006-1598AN HTTPD 1.42n, and possibly other versions before 1.42p, al…
• CVE-2006-1599Unspecified vulnerability in VCEngine.php in v-creator befor…
• CVE-2006-1600SQL injection vulnerability in category.php in PhpWebGallery…
• CVE-2006-1601Unspecified vulnerability in SunPlex Manager in Sun Cluster …
• CVE-2006-1602PHP remote file inclusion vulnerability in includes/function…