{"schemaVersion":3,"id":"CVE-2006-0208","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Multiple cross-site scripting (XSS) vulnerabilities in PHP 4.4.1 and 5.1.1, when display_errors and html_errors are on, allow remote attackers to inject arbitrary web script or HTML via inputs to PHP applications that are not filtered when they are included in the resulting error message.","dates":{"published":"2006-01-13T23:00:00.000Z","modified":"2024-08-07T16:25:33.982Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":2.6,"severity":"low","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":2.6,"severity":"low","vector":"AV:N/AC:H/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.03774,"percentile":0.8982,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.03774},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03774,"percentile":0.8982}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.03774,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.03774,"percentile":0.8982}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"php","product":"php","name":"PHP","label":"php","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.0:beta_4_patch1","noFixRecorded":false,"fixedIn":null},{"text":"4.0:beta1","noFixRecorded":false,"fixedIn":null},{"text":"4.0:beta2","noFixRecorded":false,"fixedIn":null},{"text":"4.0:beta3","noFixRecorded":false,"fixedIn":null},{"text":"4.0:beta4","noFixRecorded":false,"fixedIn":null},{"text":"4.0:rc1","noFixRecorded":false,"fixedIn":null},{"text":"4.0:rc2","noFixRecorded":false,"fixedIn":null},{"text":"4.0.0","noFixRecorded":false,"fixedIn":null},{"text":"4.0.1","noFixRecorded":false,"fixedIn":null},{"text":"4.0.2","noFixRecorded":false,"fixedIn":null},{"text":"4.0.3","noFixRecorded":false,"fixedIn":null},{"text":"4.0.4","noFixRecorded":false,"fixedIn":null},{"text":"4.0.5","noFixRecorded":false,"fixedIn":null},{"text":"4.0.6","noFixRecorded":false,"fixedIn":null},{"text":"4.1.0","noFixRecorded":false,"fixedIn":null},{"text":"4.1.1","noFixRecorded":false,"fixedIn":null},{"text":"4.1.2","noFixRecorded":false,"fixedIn":null},{"text":"4.2.0","noFixRecorded":false,"fixedIn":null},{"text":"4.2.1","noFixRecorded":false,"fixedIn":null},{"text":"4.2.2","noFixRecorded":false,"fixedIn":null},{"text":"4.2.3","noFixRecorded":false,"fixedIn":null},{"text":"4.3.0","noFixRecorded":false,"fixedIn":null},{"text":"4.3.1","noFixRecorded":false,"fixedIn":null},{"text":"4.3.2","noFixRecorded":false,"fixedIn":null},{"text":"4.3.3","noFixRecorded":false,"fixedIn":null},{"text":"4.3.4","noFixRecorded":false,"fixedIn":null},{"text":"4.3.5","noFixRecorded":false,"fixedIn":null},{"text":"4.3.6","noFixRecorded":false,"fixedIn":null},{"text":"4.3.7","noFixRecorded":false,"fixedIn":null},{"text":"4.3.8","noFixRecorded":false,"fixedIn":null},{"text":"4.3.9","noFixRecorded":false,"fixedIn":null},{"text":"4.3.10","noFixRecorded":false,"fixedIn":null},{"text":"4.3.11","noFixRecorded":false,"fixedIn":null},{"text":"4.4.1","noFixRecorded":false,"fixedIn":null},{"text":"4.4.2","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:beta1","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:beta2","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:beta3","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:rc1","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:rc2","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0:rc3","noFixRecorded":false,"fixedIn":null},{"text":"5.0.1","noFixRecorded":false,"fixedIn":null},{"text":"5.0.2","noFixRecorded":false,"fixedIn":null},{"text":"5.0.3","noFixRecorded":false,"fixedIn":null},{"text":"5.0.4","noFixRecorded":false,"fixedIn":null},{"text":"5.0.5","noFixRecorded":false,"fixedIn":null},{"text":"5.1.0","noFixRecorded":false,"fixedIn":null},{"text":"5.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.0:beta_4_patch1 | 4.0:beta1 | 4.0:beta2 | 4.0:beta3 | 4.0:beta4 | 4.0:rc1 | 4.0:rc2 | 4.0.0 | 4.0.1 | 4.0.2 | 4.0.3 | 4.0.4 | 4.0.5 | 4.0.6 | 4.1.0 | 4.1.1 | 4.1.2 | 4.2.0 | 4.2.1 | 4.2.2 | 4.2.3 | 4.3.0 | 4.3.1 | 4.3.2 | 4.3.3 | 4.3.4 | 4.3.5 | 4.3.6 | 4.3.7 | 4.3.8 | 4.3.9 | 4.3.10 | 4.3.11 | 4.4.1 | 4.4.2 | 5.0.0 | 5.0.0:beta1 | 5.0.0:beta2 | 5.0.0:beta3 | 5.0.0:rc1 | 5.0.0:rc2 | 5.0.0:rc3 | 5.0.1 | 5.0.2 | 5.0.3 | 5.0.4 | 5.0.5 | 5.1.0 | 5.1.1","eol":{"isEol":true,"eolDate":"2005-09-05T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"5.0","label":"5.0","eolFrom":"2005-09-05T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"5.0.5"},"product":{"name":"php","label":"PHP","category":"lang"}},"hubHref":"/vendor/php/php"}],"affectedCount":1,"eol":{"hasEol":true,"count":1},"references":[{"url":"http://secunia.com/advisories/19355","label":"secunia.com/advisories/19355","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/21252","label":"secunia.com/advisories/21252","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"https://usn.ubuntu.com/261-1/","label":"usn.ubuntu.com/261-1/","hostname":"usn.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU"]},{"url":"http://lists.suse.de/archive/suse-security-announce/2006-Feb/0008.html","label":"lists.suse.de/archive/suse-security-announce/2006-Feb/0008.html","hostname":"lists.suse.de","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://secunia.com/advisories/18431","label":"secunia.com/advisories/18431","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/20222","label":"secunia.com/advisories/20222","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://secunia.com/advisories/20210","label":"secunia.com/advisories/20210","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://www.vupen.com/english/advisories/2006/0369","label":"www.vupen.com/english/advisories/2006/0369","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Vendor Advisory"]},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2006-160.htm","label":"support.avaya.com/elmodocs2/security/ASA-2006-160.htm","hostname":"support.avaya.com","tags":["X Refsource CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2006/0177","label":"www.vupen.com/english/advisories/2006/0177","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Vendor Advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2006-0276.html","label":"rhn.redhat.com/errata/RHSA-2006-0276.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://secunia.com/advisories/19179","label":"secunia.com/advisories/19179","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Patch","Vendor Advisory"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200603-22.xml","label":"www.gentoo.org/security/en/glsa/glsa-200603-22.xml","hostname":"www.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO","Patch"]},{"url":"https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178028","label":"bugzilla.redhat.com/bugzilla/show_bug.cgi?id=178028","hostname":"bugzilla.redhat.com","tags":["X Refsource MISC"]},{"url":"http://www.redhat.com/support/errata/RHSA-2006-0501.html","label":"www.redhat.com/support/errata/RHSA-2006-0501.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://rhn.redhat.com/errata/RHSA-2006-0549.html","label":"rhn.redhat.com/errata/RHSA-2006-0549.html","hostname":"rhn.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://secunia.com/advisories/18697","label":"secunia.com/advisories/18697","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/20951","label":"secunia.com/advisories/20951","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://support.avaya.com/elmodocs2/security/ASA-2006-129.htm","label":"support.avaya.com/elmodocs2/security/ASA-2006-129.htm","hostname":"support.avaya.com","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/19832","label":"secunia.com/advisories/19832","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10064","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10064","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://www.mandriva.com/security/advisories?name=MDKSA-2006:028","label":"www.mandriva.com/security/advisories?name=MDKSA-2006:028","hostname":"www.mandriva.com","tags":["Vendor Advisory","X Refsource MANDRIVA"]},{"url":"http://www.php.net/release_5_1_2.php","label":"www.php.net/release_5_1_2.php","hostname":"www.php.net","tags":["X Refsource CONFIRM","Patch"]},{"url":"http://www.securityfocus.com/bid/16803","label":"www.securityfocus.com/bid/16803","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Patch"]},{"url":"http://secunia.com/advisories/21564","label":"secunia.com/advisories/21564","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://secunia.com/advisories/19012","label":"secunia.com/advisories/19012","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://www.php.net/ChangeLog-4.php#4.4.2","label":"www.php.net/ChangeLog-4.php","hostname":"www.php.net","tags":["X Refsource CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2006/2685","label":"www.vupen.com/english/advisories/2006/2685","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":["RHSA-2006:0276"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2006-01-13T23:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T16:25:33.982Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":11,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T19:01:52.952Z","stale":false,"partial":false}}