Back to CVE Browser

CVE-2006-3616

MEDIUM

4.3

CVSS Severity Score

EPSS Score0.1850%

EPSS Percentile12.93th

PublishedJul 18, 2006

Last ModifiedApr 16, 2026

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in Carbonize Lazarus Guestbook 1.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the show parameter in codes-english.php and (2) the img parameter in picture.php, after the name of an existing file.

Affected Platforms (CPE)

📦

Carbonize

Lazarus Guestbook

<= 1.6

References & Advisories

🔗 http://secunia.com/advisories/21034

🔗 http://securitytracker.com/id?1016486

🔗 http://www.osvdb.org/27089

🔗 http://www.osvdb.org/27090

🔗 http://www.securityfocus.com/archive/1/439904/100/0/threaded

🔗 http://www.securityfocus.com/bid/18956

🔗 http://www.vupen.com/english/advisories/2006/2784

🔗 https://exchange.xforce.ibmcloud.com/vulnerabilities/27714

Related Vulnerabilities

CVE-2007-148610.0

PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before 1.7.3 allows remote attackers ...

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc (GRPC.Compressor.Gzip, GRPC.Mes...

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust...

Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc all...