← Vulnerability feed

Vulnerability record · CVE-2006-1033 · published 7 March 2006

CVE-2006-1033: Cpg-nuke dragonfly cms vulnerability

CCpg Nuke · Dragonfly Cms

Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arbitrary web script or HTML via (1) uname, (2) error, (3) profile or (4) the username filed parameter to the (a) Your_Account module, (5) catid, (6) sid, (7) Story Text or (8) Extended text text fields in the (b) News module, (9) month, (10) year or (11) sa parameter to the (c) Stories_Archive module, (12) show, (13) cid, (14) ratetype, or (15) orderby parameter to the (d) Web_Links module, (16) op, or (17) pollid parameter to the (e) Surveys module, (18) c parameter to the (f) Downloads module, (19) meta, or (20) album parameter to the (g) coppermine module, or the search box in the (21) Search, (22) Stories_Archive, (23) Downloads, and (24) Topics module.

4.3 CVSS 2.0 Medium EPSS 1.9% · top 20.6%
4.3CVSS 2.0 base score
1.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References, 6 tagged exploit
16 Jun 2026Last modified by NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Dragonfly CMS before 9.0.6.1 allow remote attackers to inject arbitrary web script or HTML via (1) uname, (2) error, (3) profile or (4) the username filed parameter to the (a) Your_Account module, (5) catid, (6) sid, (7) Story Text or (8) Extended text text fields in the (b) News module, (9) month, (10) year or (11) sa parameter to the (c) Stories_Archive module, (12) show, (13) cid, (14) ratetype, or (15) orderby parameter to the (d) Web_Links module, (16) op, or (17) pollid parameter to the (e) Surveys module, (18) c parameter to the (f) Downloads module, (19) meta, or (20) album parameter to the (g) coppermine module, or the search box in the (21) Search, (22) Stories_Archive, (23) Downloads, and (24) Topics module.

AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://lostmon.blogspot.com/2006/02/multiple-cross-site-scripting-in.html ExploitVendor Advisory
http://secunia.com/advisories/18940 Vendor Advisory
http://securitytracker.com/id?1015661 Exploit
http://www.securityfocus.com/bid/16784 Exploit
http://www.vupen.com/english/advisories/2006/0688
https://exchange.xforce.ibmcloud.com/vulnerabilities/24843
http://lostmon.blogspot.com/2006/02/multiple-cross-site-scripting-in.html ExploitVendor Advisory
http://secunia.com/advisories/18940 Vendor Advisory
http://securitytracker.com/id?1015661 Exploit
http://www.securityfocus.com/bid/16784 Exploit
http://www.vupen.com/english/advisories/2006/0688
https://exchange.xforce.ibmcloud.com/vulnerabilities/24843

Track CVE-2006-1033 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2006-0644Cpg-nuke dragonfly cms vulnerabilityMultiple directory traversal vulnerabilities in install.php in CPG-Nuke Dragonfly CMS (aka CPG Dragonfly CMS) 9.0.6.1 allow remote attackers to inclu…EPSS 8.4%6.8CVE-2006-4162Cpg-nuke dragonfly cms vulnerabilityCross-site scripting (XSS) vulnerability in Dragonfly CMS 9.0.6.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the …EPSS 1.3%4.3CVE-2006-0726Cpg-nuke dragonfly cms vulnerabilityCross-site scripting (XSS) vulnerability in linking.php in CPG-Nuke Dragonfly CMS 9.0.6.1 allows remote attackers to inject arbitrary web script or H…EPSS 1.7%

Source: NIST National Vulnerability Database (record CVE-2006-1033), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.