CVE-2006-2689: Eva-Web

Medium severity, CVSS 6.8. EPSS: 2% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) debut_image parameter in (a) article-album.php3, (2) date parameter in (b) rubrique.php3, and the (3) perso and (4) aide parameters to (c) an unknown script, probably index.php.

Affected products

• Eva-Web Eva-Web: up to and including 2.1.2

Published 2006-05-31. Last modified 2026-06-16.