CVE-2006-2611

Cross-site scripting (XSS) vulnerability in includes/Sanitizer.php in the variable handler in MediaWiki 1.6.x before r14349 allows remote attackers to inject arbitrary Javascript via unspecified vectors, possibly involving the usage of the | (pipe) character.

• http://bugzilla.wikimedia.org/show_bug.cgi?id=6055Exploit, Patch
• http://mail.wikipedia.org/pipermail/wikitech-l/2006-May/035812.htmlExploit
• http://mail.wikipedia.org/pipermail/wikitech-l/2006-May/035814.htmlPatch
• http://nickj.org/MediaWiki
• http://secunia.com/advisories/20189Patch, Vendor Advisory
• http://svn.wikimedia.org/viewvc/mediawiki/trunk/phase3/includes/Sanitizer.php?r1=14349&r2=14348&pathrev=14349Patch
• http://svn.wikimedia.org/viewvc/mediawiki?view=rev&revision=14349Patch
• http://www.osvdb.org/25713
• http://www.vupen.com/english/advisories/2006/1926
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26646
• http://bugzilla.wikimedia.org/show_bug.cgi?id=6055Exploit, Patch
• http://mail.wikipedia.org/pipermail/wikitech-l/2006-May/035812.htmlExploit
• http://mail.wikipedia.org/pipermail/wikitech-l/2006-May/035814.htmlPatch
• http://nickj.org/MediaWiki
• http://secunia.com/advisories/20189Patch, Vendor Advisory
• http://svn.wikimedia.org/viewvc/mediawiki/trunk/phase3/includes/Sanitizer.php?r1=14349&r2=14348&pathrev=14349Patch
• http://svn.wikimedia.org/viewvc/mediawiki?view=rev&revision=14349Patch
• http://www.osvdb.org/25713
• http://www.vupen.com/english/advisories/2006/1926
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26646

Published

May 26, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-2605Cross-site scripting (XSS) vulnerability in DSChat 1.0 and e…
• CVE-2006-2606Cross-site scripting (XSS) vulnerability in Chatty, possibly…
• CVE-2006-2607do_command.c in Vixie cron (vixie-cron) 4.1 does not check t…
• CVE-2006-2608artmedic newsletter 4.1 and possibly other versions, when re…
• CVE-2006-2609artmedic newsletter 4.1.2 and possibly other versions, when …
• CVE-2006-2610Cross-site scripting (XSS) vulnerability in view.php in phpR…
• CVE-2006-2612Novell Client for Windows 4.8 and 4.9 does not restrict acce…
• CVE-2006-2613Mozilla Suite 1.7.13, Mozilla Firefox 1.5.0.3 and possibly o…
• CVE-2006-2614Sun N1 System Manager 1.1 for Solaris 10 before patch 121161…
• CVE-2006-2615ping.php in Russcom.Ping allows remote attackers to execute …
• CVE-2006-2616SQL injection vulnerability in the search script in (1) Alst…
• CVE-2006-2617(1) AlstraSoft Web Host Directory 1.2, aka (2) HyperStop Web…