CVE-2006-5791

Severity: low (CVSS 2.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-11-07 · updated 2026-06-16

Description

Multiple cross-site scripting (XSS) vulnerabilities in elogd.c in ELOG 2.6.2 and earlier allow remote attackers to inject arbitrary HTML or web script via (1) the filename for downloading, which is not quoted in an error message by the send_file_direct function, and (2) the Type or Category values in a New entry, which is not properly handled in an error message by the submit_elog function.

Affected products

Stefan Ritt Elog Web Logbook: through 2.6.2

References

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=392016
http://secunia.com/advisories/22638
http://secunia.com/advisories/23580
http://www.debian.org/security/2006/dsa-1242
http://www.securityfocus.com/bid/20881
http://www.securityfocus.com/bid/20882
http://www.vupen.com/english/advisories/2006/4315
https://exchange.xforce.ibmcloud.com/vulnerabilities/29986
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=392016
http://secunia.com/advisories/22638
http://secunia.com/advisories/23580
http://www.debian.org/security/2006/dsa-1242

Get alerted when CVE-2006-5791 or the next vulnerability affects your stack