CVE-2006-1681

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-04-11 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in Cherokee HTTPD 0.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated.

Affected products

Cherokee Httpd: 0.1, 0.1.5, 0.1.6, 0.2, 0.2.5, 0.2.6 (+7)

References

http://secunia.com/advisories/19587
http://www.osvdb.org/24469
http://www.securityfocus.com/archive/1/430385/100/0/threaded
http://www.securityfocus.com/bid/17408
http://www.vupen.com/english/advisories/2006/1292
https://exchange.xforce.ibmcloud.com/vulnerabilities/25698
https://security.gentoo.org/glsa/202012-09
http://secunia.com/advisories/19587
http://www.osvdb.org/24469
http://www.securityfocus.com/archive/1/430385/100/0/threaded
http://www.securityfocus.com/bid/17408
http://www.vupen.com/english/advisories/2006/1292

Get alerted when CVE-2006-1681 or the next vulnerability affects your stack