CVE-2006-2784

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-06-02 · updated 2026-06-16
Weakness: CWE-264

Description

The PLUGINSPAGE functionality in Mozilla Firefox before 1.5.0.4 allows remote user-assisted attackers to execute privileged code by tricking a user into installing missing plugins and selecting the "Manual Install" button, then using nested javascript: URLs. NOTE: the manual install button is used for downloading software from a remote web site, so this issue would not cross privilege boundaries if the user progresses to the point of installing malicious software from the attacker-controlled site.

Affected products

Mozilla Firefox: through 1.5.0.3

References

http://rhn.redhat.com/errata/RHSA-2006-0609.html
http://secunia.com/advisories/20376
http://secunia.com/advisories/20561
http://secunia.com/advisories/21134
http://secunia.com/advisories/21176
http://secunia.com/advisories/21178
http://secunia.com/advisories/21183
http://secunia.com/advisories/21188
http://secunia.com/advisories/21210
http://secunia.com/advisories/21269
http://secunia.com/advisories/21270
http://secunia.com/advisories/21324

Get alerted when CVE-2006-2784 or the next vulnerability affects your stack