CVE-2006-2746

Multiple cross-site scripting (XSS) vulnerabilities in F@cile Interactive Web 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) lang parameter in index.php, and the (2) mytheme and (3) myskin parameters in multiple "p-themes" index.inc.php files including (c) lowgraphic, (d) classic, (e) puzzle, (f) simple, and (g) ciao. NOTE: vectors 2 and 3 might be resultant from file inclusion issues.

• http://secunia.com/advisories/20358Exploit, Vendor Advisory
• http://securityreason.com/securityalert/1010
• http://www.nukedx.com/?getxpl=35Exploit
• http://www.nukedx.com/?viewdoc=35Exploit, Vendor Advisory
• http://www.osvdb.org/26104
• http://www.osvdb.org/26105
• http://www.securityfocus.com/archive/1/435283/100/0/threaded
• http://www.securityfocus.com/bid/18151Exploit
• http://www.vupen.com/english/advisories/2006/2036
• http://secunia.com/advisories/20358Exploit, Vendor Advisory
• http://securityreason.com/securityalert/1010
• http://www.nukedx.com/?getxpl=35Exploit
• http://www.nukedx.com/?viewdoc=35Exploit, Vendor Advisory
• http://www.osvdb.org/26104
• http://www.osvdb.org/26105
• http://www.securityfocus.com/archive/1/435283/100/0/threaded
• http://www.securityfocus.com/bid/18151Exploit
• http://www.vupen.com/english/advisories/2006/2036

Published

Jun 1, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-2740Multiple SQL injection vulnerabilities in Epicdesigns tinyBB…
• CVE-2006-2741Cross-site scripting (XSS) vulnerability in Epicdesigns tiny…
• CVE-2006-2742SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and…
• CVE-2006-2743Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache …
• CVE-2006-2744PHP remote file inclusion vulnerability in p-popupgallery.ph…
• CVE-2006-2745Multiple PHP remote file inclusion vulnerabilities in F@cile…
• CVE-2006-2747Directory traversal vulnerability in index.php in PhpMyDeskt…
• CVE-2006-2748SQL injection vulnerability in the do_mysql_query function i…
• CVE-2006-2749SQL injection vulnerability in search.php in Open Searchable…
• CVE-2006-2750Cross-site scripting (XSS) vulnerability in the do_mysql_que…
• CVE-2006-2751Cross-site scripting (XSS) vulnerability in Open Searchable …
• CVE-2006-2752The RedCarpet /etc/ximian/rcd.conf configuration file in Nov…