CVE-2006-3160

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-06-22 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in fm.php in ONEdotOH Simple File Manager (SFM) 0.24a and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

Affected products

Onedotoh Simple File Manager: through 0.24a

References

http://secunia.com/advisories/20668
http://www.osvdb.org/26665
http://www.securityfocus.com/archive/1/437671/100/100/threaded
http://www.securityfocus.com/bid/18534
http://www.vupen.com/english/advisories/2006/2435
https://exchange.xforce.ibmcloud.com/vulnerabilities/27306
http://secunia.com/advisories/20668
http://www.osvdb.org/26665
http://www.securityfocus.com/archive/1/437671/100/100/threaded
http://www.securityfocus.com/bid/18534
http://www.vupen.com/english/advisories/2006/2435
https://exchange.xforce.ibmcloud.com/vulnerabilities/27306

Get alerted when CVE-2006-3160 or the next vulnerability affects your stack