Read the docs
TI-2006-02748 Aliases CVE-2006-2840GHSA-772j-g7pw-69xq

Cross-site scripting (XSS) vulnerability in (1) uploads.php and (2) "url links" in PmWiki…

Priority LOW 33Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Cross-site scripting (XSS) vulnerability in (1) uploads.php and (2) "url links" in PmWiki 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

Why it matters now

EPSS 0.01309 70th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:a:pmwiki:pmwiki:*:*:*:*:*:*:*:*up to 2.1.6Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.0.0:*:*:*:*:*:*:*2.0.0Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.0.1:*:*:*:*:*:*:*2.0.1Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.0.2:*:*:*:*:*:*:*2.0.2Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.0.3:*:*:*:*:*:*:*2.0.3Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.0.4:*:*:*:*:*:*:*2.0.4Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.0.5:*:*:*:*:*:*:*2.0.5Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.0.6:*:*:*:*:*:*:*2.0.6Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.0.7:*:*:*:*:*:*:*2.0.7Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.0.8:*:*:*:*:*:*:*2.0.8Vulnerablepmwiki
  • cpe:2.3:a:pmwiki:pmwiki:*:*:*:*:*:*:*:* Versions up to 2.1.6 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.0.6:*:*:*:*:*:*:* Versions 2.0.6 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.0.7:*:*:*:*:*:*:* Versions 2.0.7 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.0.8:*:*:*:*:*:*:* Versions 2.0.8 Vulnerable ·pmwiki
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:pmwiki:pmwiki:2.0.9:*:*:*:*:*:*:*2.0.9Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.0.10:*:*:*:*:*:*:*2.0.10Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.0.11:*:*:*:*:*:*:*2.0.11Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.0.12:*:*:*:*:*:*:*2.0.12Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.0.13:*:*:*:*:*:*:*2.0.13Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.0:*:*:*:*:*:*:*2.1.0Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.1:*:*:*:*:*:*:*2.1.1Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.2:*:*:*:*:*:*:*2.1.2Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.3:*:*:*:*:*:*:*2.1.3Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.4:*:*:*:*:*:*:*2.1.4Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.5:*:*:*:*:*:*:*2.1.5Vulnerablepmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.0.9:*:*:*:*:*:*:* Versions 2.0.9 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.0.10:*:*:*:*:*:*:* Versions 2.0.10 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.0.11:*:*:*:*:*:*:* Versions 2.0.11 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.0.12:*:*:*:*:*:*:* Versions 2.0.12 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.0.13:*:*:*:*:*:*:* Versions 2.0.13 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.5:*:*:*:*:*:*:* Versions 2.1.5 Vulnerable ·pmwiki

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-2840
  2. 2026-10-03 Alias added: GHSA-772j-g7pw-69xq

References

Patch 1

Other 1

  • TI-2011-03856 The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows… CVSS 2.0HIGH 7.5
  • TI-2010-04385 PmWiki before 2.2.21 has XSS. CVSS 3.1MEDIUM 6.1
  • TI-2006-00465 pmwiki.php in PmWiki 2.1 beta 20, with register_globals enabled, allows remote attackers… CVSS 2.0MEDIUM 4.3
  • TI-2005-03643 Cross-site scripting (XSS) vulnerability in the Search module in PmWiki up to 2.0.12… CVSS 2.0MEDIUM 4.3
  • TI-2010-04471 Cross-site scripting (XSS) vulnerability in pmwiki.php in PmWiki 2.2.20 allows remote… CVSS 2.0MEDIUM 4.3
  • TI-2006-04301 Cross-site scripting (XSS) vulnerability in PmWiki before 2.1.18 allows remote attackers… CVSS 2.0MEDIUM 4.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences