Servers and applications
CVE-2006-1548
Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.
- Severity
- Medium 4.3
- Published
- 30 Mar 2006
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 5.5% in the next 30 daysHigher than 92% of CVEs. EPSS by FIRST, 12 Nov 2026
- Attack
- Over the network · No login needed
- Attacker can
- Change some data
- CVSS vector
AV:N/AC:M/Au:N/C:N/I:P/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
Apache StrutsServers and applications · cpe:a:apache:struts |
|