← Vulnerability feed

Vulnerability record · CVE-2006-5453 · published 23 October 2006

CVE-2006-5453: Mozilla bugzilla vulnerability

Mozilla · Bugzilla

Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) page headers using the H1, H2, and H3 HTML tags in global/header.html.tmpl, (2) description fields of certain items in various edit cgi scripts, and (3) the id parameter in showdependencygraph.cgi.

3.5 CVSS 2.0 Low EPSS 2.0% · top 19.6%
3.5CVSS 2.0 base score
2.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
38References
16 Jun 2026Last modified by NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) page headers using the H1, H2, and H3 HTML tags in global/header.html.tmpl, (2) description fields of certain items in various edit cgi scripts, and (3) the id parameter in showdependencygraph.cgi.

AV:N/AC:M/Au:S/C:N/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/22409
http://secunia.com/advisories/22790
http://secunia.com/advisories/22826
http://security.gentoo.org/glsa/glsa-200611-04.xml
http://securityreason.com/securityalert/1760
http://securitytracker.com/id?1017063 Patch
http://www.bugzilla.org/security/2.18.5/
http://www.debian.org/security/2006/dsa-1208
http://www.osvdb.org/29544
http://www.osvdb.org/29545 Patch
http://www.osvdb.org/29549
http://www.securityfocus.com/archive/1/448777/100/100/threaded
http://www.securityfocus.com/bid/20538
http://www.vupen.com/english/advisories/2006/4035
https://bugzilla.mozilla.org/show_bug.cgi?id=206037 Patch
https://bugzilla.mozilla.org/show_bug.cgi?id=330555 Patch
https://bugzilla.mozilla.org/show_bug.cgi?id=355728 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/29610
https://exchange.xforce.ibmcloud.com/vulnerabilities/29619
http://secunia.com/advisories/22409
http://secunia.com/advisories/22790
http://secunia.com/advisories/22826
http://security.gentoo.org/glsa/glsa-200611-04.xml
http://securityreason.com/securityalert/1760
http://securitytracker.com/id?1017063 Patch
http://www.bugzilla.org/security/2.18.5/
http://www.debian.org/security/2006/dsa-1208
http://www.osvdb.org/29544
http://www.osvdb.org/29545 Patch
http://www.osvdb.org/29549
http://www.securityfocus.com/archive/1/448777/100/100/threaded
http://www.securityfocus.com/bid/20538
http://www.vupen.com/english/advisories/2006/4035
https://bugzilla.mozilla.org/show_bug.cgi?id=206037 Patch
https://bugzilla.mozilla.org/show_bug.cgi?id=330555 Patch
https://bugzilla.mozilla.org/show_bug.cgi?id=355728 Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/29610
https://exchange.xforce.ibmcloud.com/vulnerabilities/29619

Track CVE-2006-5453 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2003-1043Mozilla bugzilla vulnerabilitySQL injection vulnerability in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote authenticated users with editkeywords privileges…EPSS 2.6%10.0CVE-2004-0769Mozilla bugzilla vulnerabilityBuffer overflow in LHA allows remote attackers to execute arbitrary code via long pathnames in LHarc format 2 headers for a .LHZ archive, as original…EPSS 7.1%10.0CVE-2003-1042Mozilla bugzilla vulnerabilitySQL injection vulnerability in collectstats.pl for Bugzilla 2.16.3 and earlier allows remote authenticated users with editproducts privileges to exec…EPSS 2.6%10.0CVE-2002-0007Mozilla bugzilla vulnerabilityCGI.pl in Bugzilla before 2.14.1, when using LDAP, allows remote attackers to obtain an anonymous bind to the LDAP server via a request that does not…EPSS 2.4%8.8CVE-2018-5123Mozilla bugzilla cross-site request forgery vulnerabilityA third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in al…EPSS 0.50%7.5CVE-2015-4499Mozilla bugzilla improper input validation vulnerabilityUtil.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during acco…EPSS 3.4%7.5CVE-2010-4568Mozilla bugzilla permissions and access controls vulnerabilityBugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not proper…EPSS 2.5%7.5CVE-2009-3125Mozilla bugzilla sql injection vulnerabilitySQL injection vulnerability in the Bug.search WebService function in Bugzilla 3.3.2 through 3.4.1, and 3.5, allows remote attackers to execute arbitr…EPSS 1.4%

Source: NIST National Vulnerability Database (record CVE-2006-5453), CISA KEV, FIRST EPSS (scores of 2026-10-02). This page is refreshed as NVD updates the record.