CVE-2006-5859

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-02-14 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Adobe ColdFusion MX 7 7.0 and 7.0.1, when Global Script Protection is not enabled, allows remote attackers to inject arbitrary HTML and web script via unknown vectors, possibly related to Linkdirect.cfm, Topnav.cfm, and Welcomedoc.cfm.

Affected products

Adobe ColdFusion: 7.0, 7.0.1

References

http://osvdb.org/32121
http://secunia.com/advisories/24115
http://www.adobe.com/support/security/bulletins/apsb07-03.html
http://www.securityfocus.com/bid/22544
http://www.securitytracker.com/id?1017644
http://www.vupen.com/english/advisories/2007/0592
http://osvdb.org/32121
http://secunia.com/advisories/24115
http://www.adobe.com/support/security/bulletins/apsb07-03.html
http://www.securityfocus.com/bid/22544
http://www.securitytracker.com/id?1017644
http://www.vupen.com/english/advisories/2007/0592

Get alerted when CVE-2006-5859 or the next vulnerability affects your stack