CVE-2006-7158

Cross-site scripting (XSS) vulnerability in Oracle Application Express (APEX) before 2.2.1, aka Oracle HTML DB, allows remote attackers to inject arbitrary web script or HTML via the NOTIFICATION_MSG parameter. NOTE: it is likely that this issue overlaps one of the identifiers in CVE-2006-5351.

• http://secunia.com/advisories/22396Vendor Advisory
• http://securityreason.com/securityalert/2382
• http://www.red-database-security.com/advisory/oracle_apex_css_notification_msg.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/archive/1/449501/100/0/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30107
• http://secunia.com/advisories/22396Vendor Advisory
• http://securityreason.com/securityalert/2382
• http://www.red-database-security.com/advisory/oracle_apex_css_notification_msg.htmlPatch, Vendor Advisory
• http://www.securityfocus.com/archive/1/449501/100/0/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30107

Published

Mar 7, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-7152default.asp in ASP-Nuke Community 1.5 and earlier allows rem…
• CVE-2006-7153PHP remote file inclusion vulnerability in index.php in Mini…
• CVE-2006-7154Iono allows remote attackers to obtain the full server path …
• CVE-2006-7155Novell BorderManager 3.8 SP4 generates the same ISAKMP cooki…
• CVE-2006-7156PHP remote file inclusion vulnerability in addon_keywords.ph…
• CVE-2006-7157Buffer overflow in Google Earth v4.0.2091 (beta) allows remo…
• CVE-2006-7159Directory traversal vulnerability in include/prune_torrents.…
• CVE-2006-7160The Sandbox.sys driver in Outpost Firewall PRO 4.0, and poss…
• CVE-2006-7161SQL injection vulnerability in giris_yap.asp in Hazir Site 2…
• CVE-2006-7162PuTTY 0.59 and earlier uses weak file permissions for (1) pp…
• CVE-2006-7163DreameeSoft Password Master 1.0 stores the database in an un…
• CVE-2006-7164SimpleFileServlet in IBM WebSphere Application Server 5.0.1 …