CVE-2006-4973

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-09-25 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in Default.aspx in Perpetual Motion Interactive Systems DotNetNuke before 3.3.5, and 4.x before 4.3.5, allows remote attackers to inject arbitrary HTML via the error parameter.

Affected products

DotNetNuke CMS Fixed in 9.1.1: 1.0.6, 1.0.7, 1.0.8, 1.0.9, 1.0.10d, 1.0.10e (+6)

References

http://secunia.com/advisories/22051
http://www.dotnetnuke.com/About/WhatIsDotNetNuke/SecurityPolicy/SecurityBulletinno3/tabid/990/Default.aspx
http://www.secureshapes.com/advisories/vuln20-09-2006.htm
http://www.securityfocus.com/bid/20117
http://www.vupen.com/english/advisories/2006/3734
https://exchange.xforce.ibmcloud.com/vulnerabilities/29048
http://secunia.com/advisories/22051
http://www.dotnetnuke.com/About/WhatIsDotNetNuke/SecurityPolicy/SecurityBulletinno3/tabid/990/Default.aspx
http://www.secureshapes.com/advisories/vuln20-09-2006.htm
http://www.securityfocus.com/bid/20117
http://www.vupen.com/english/advisories/2006/3734
https://exchange.xforce.ibmcloud.com/vulnerabilities/29048

Get alerted when CVE-2006-4973 or the next vulnerability affects your stack