CVE-2006-3555

Published: Jul 13, 2006Modified: Apr 16, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in submit.php in PHP-Fusion before 6.01.3 allow remote attackers to inject arbitrary web script or HTML by using edit_profile.php to upload a (1) avatar or (2) forum image attachment that has a .gif or .jpg extension, and begins with a GIF header followed by JavaScript code, which is executed by Internet Explorer.

Affected (26)

Products: Php Fusion: Php Fusion

Php Fusion

1 product

Php Fusion

Configuration A

26 vulnerable

Vulnerable Software	Affected Versions
Php Fusion Php Fusion	Version 6.0.105
Php Fusion Php Fusion	Version 6.0.106
Php Fusion Php Fusion	Version 6.0.107
Php Fusion Php Fusion	Version 6.00.100
Php Fusion Php Fusion	Version 6.00.101
Php Fusion Php Fusion	Version 6.00.102
Php Fusion Php Fusion	Version 6.00.103
Php Fusion Php Fusion	Version 6.00.104
Php Fusion Php Fusion	Version 6.00.105
Php Fusion Php Fusion	Version 6.00.106
Php Fusion Php Fusion	Version 6.00.107
Php Fusion Php Fusion	Version 6.00.108
Php Fusion Php Fusion	Version 6.00.109
Php Fusion Php Fusion	Version 6.00.110
Php Fusion Php Fusion	Version 6.00.200
Php Fusion Php Fusion	Version 6.00.204
Php Fusion Php Fusion	Version 6.00.205
Php Fusion Php Fusion	Version 6.00.206
Php Fusion Php Fusion	Version 6.00.207
Php Fusion Php Fusion	Version 6.00.300
Php Fusion Php Fusion	Version 6.00.303
Php Fusion Php Fusion	Version 6.00.304
Php Fusion Php Fusion	Version 6.00.306
Php Fusion Php Fusion	Version 6.00.307
Php Fusion Php Fusion	Version 6.00.3
Php Fusion Php Fusion	Version 6.01.2