CVE-2006-2746: Facile Interactive Web

Medium severity, CVSS 6.8. EPSS: 3.1% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in F@cile Interactive Web 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) lang parameter in index.php, and the (2) mytheme and (3) myskin parameters in multiple "p-themes" index.inc.php files including (c) lowgraphic, (d) classic, (e) puzzle, (f) simple, and (g) ciao. NOTE: vectors 2 and 3 might be resultant from file inclusion issues.

Affected products

• Facile Interactive Web Facile Interactive Web: up to and including 0.8.5; version 0.8.41 only

Published 2006-06-01. Last modified 2026-06-16.