CVE-2006-5626

Cross-site scripting (XSS) vulnerability in cms_images/js/htmlarea/htmlarea.php in phpFaber Content Management System (CMS) before 1.3.36 on 20061026 allows remote attackers to inject arbitrary web script or HTML, probably via arbitrary parameters in the query string, as demonstrated with a vigilon parameter. NOTE: earlier downloads of 1.3.36 have the vulnerability; the software was updated without changing the version number.

• http://secunia.com/advisories/22629Exploit, Patch, Vendor Advisory
• http://securityreason.com/securityalert/1802
• http://www.securityfocus.com/archive/1/449894/100/0/threaded
• http://www.securityfocus.com/bid/20821
• http://www.vigilon.com/advisories/vg-phpfaber-24-10-2006.txt
• http://www.vigilon.com/resources/102506c.htmlExploit, Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2006/4260
• http://secunia.com/advisories/22629Exploit, Patch, Vendor Advisory
• http://securityreason.com/securityalert/1802
• http://www.securityfocus.com/archive/1/449894/100/0/threaded
• http://www.securityfocus.com/bid/20821
• http://www.vigilon.com/advisories/vg-phpfaber-24-10-2006.txt
• http://www.vigilon.com/resources/102506c.htmlExploit, Patch, Vendor Advisory
• http://www.vupen.com/english/advisories/2006/4260

Published

Oct 31, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-5620PHP remote file inclusion vulnerability in include/menu_buil…
• CVE-2006-5621PHP remote file inclusion vulnerability in end.php in ask_ra…
• CVE-2006-5622SQL injection vulnerability in picmgr.php in Coppermine Phot…
• CVE-2006-5623PHP remote file inclusion vulnerability in ip.inc.php in Ele…
• CVE-2006-5624Multiple PHP remote file inclusion vulnerabilities in Multi-…
• CVE-2006-5625PHP remote file inclusion vulnerability in wwwdev/nxheader.i…
• CVE-2006-5627Multiple PHP remote file inclusion vulnerabilities in QnECMS…
• CVE-2006-5628SQL injection vulnerability in login.asp in UNISOR Content M…
• CVE-2006-5629Multiple SQL injection vulnerabilities in Hosting Controller…
• CVE-2006-5630Hosting Controller 6.1 before Hotfix 3.3 allows remote attac…
• CVE-2006-5631Cross-site scripting (XSS) vulnerability in change_pass.php …
• CVE-2006-5632Cross-site scripting (XSS) vulnerability in change_pass.php …6.1