What’s Vulnerable › Vulnerabilities

CVE-2006-2900

• Severity: medium (CVSS 4.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 12.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2006-06-07 · updated 2026-06-16
• Weakness: CWE-200

Description

Internet Explorer 6 allows user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a text box and using the OnKeyDown, OnKeyPress, and OnKeyUp Javascript keystroke events to change the focus and cause those characters to be inserted into a file upload input control, which can then upload the file when the user submits the form.

Affected products

• Canon Network Camera Server Vb101: all versions
• Microsoft Ie: 5.01-windows_2000_sp4, 6, 6-sp1, 6-windows_2000_sp4, 6-windows_server_2003_sp1, 6-windows_server_2003_sp1_itanium (+1)

References

• http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046610.html
• http://secunia.com/advisories/20449
• http://securityreason.com/securityalert/1059
• http://www.securityfocus.com/bid/18308
• http://www.vupen.com/english/advisories/2006/2161
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046610.html
• http://secunia.com/advisories/20449
• http://securityreason.com/securityalert/1059
• http://www.securityfocus.com/bid/18308
• http://www.vupen.com/english/advisories/2006/2161

Get alerted when CVE-2006-2900 or the next vulnerability affects your stack