Read the docs
TI-2006-04301 Aliases CVE-2006-4453GHSA-47h6-r92h-qgwj

Cross-site scripting (XSS) vulnerability in PmWiki before 2.1.18 allows remote attackers…

Priority LOW 22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Cross-site scripting (XSS) vulnerability in PmWiki before 2.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving "table markups".

Why it matters now

EPSS 0.0118 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:pmwiki:pmwiki:2.1.0:*:*:*:*:*:*:*2.1.0Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.1:*:*:*:*:*:*:*2.1.1Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.2:*:*:*:*:*:*:*2.1.2Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.3:*:*:*:*:*:*:*2.1.3Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.4:*:*:*:*:*:*:*2.1.4Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.5:*:*:*:*:*:*:*2.1.5Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.6:*:*:*:*:*:*:*2.1.6Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.7:*:*:*:*:*:*:*2.1.7Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.8:*:*:*:*:*:*:*2.1.8Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.9:*:*:*:*:*:*:*2.1.9Vulnerablepmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.3:*:*:*:*:*:*:* Versions 2.1.3 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.4:*:*:*:*:*:*:* Versions 2.1.4 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.5:*:*:*:*:*:*:* Versions 2.1.5 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.6:*:*:*:*:*:*:* Versions 2.1.6 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.7:*:*:*:*:*:*:* Versions 2.1.7 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.8:*:*:*:*:*:*:* Versions 2.1.8 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.9:*:*:*:*:*:*:* Versions 2.1.9 Vulnerable ·pmwiki
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:pmwiki:pmwiki:2.1.10:*:*:*:*:*:*:*2.1.10Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.11:*:*:*:*:*:*:*2.1.11Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.12:*:*:*:*:*:*:*2.1.12Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.13:*:*:*:*:*:*:*2.1.13Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.14:*:*:*:*:*:*:*2.1.14Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.15:*:*:*:*:*:*:*2.1.15Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.16:*:*:*:*:*:*:*2.1.16Vulnerablepmwiki
cpe:2.3:a:pmwiki:pmwiki:2.1.17:*:*:*:*:*:*:*2.1.17Vulnerablepmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.10:*:*:*:*:*:*:* Versions 2.1.10 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.11:*:*:*:*:*:*:* Versions 2.1.11 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.12:*:*:*:*:*:*:* Versions 2.1.12 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.13:*:*:*:*:*:*:* Versions 2.1.13 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.14:*:*:*:*:*:*:* Versions 2.1.14 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.15:*:*:*:*:*:*:* Versions 2.1.15 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.16:*:*:*:*:*:*:* Versions 2.1.16 Vulnerable ·pmwiki
  • cpe:2.3:a:pmwiki:pmwiki:2.1.17:*:*:*:*:*:*:* Versions 2.1.17 Vulnerable ·pmwiki

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2006-4453
  2. 2026-10-03 Alias added: GHSA-47h6-r92h-qgwj

References

Other 2

  • TI-2011-03856 The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows… CVSS 2.0HIGH 7.5
  • TI-2006-02748 Cross-site scripting (XSS) vulnerability in (1) uploads.php and (2) "url links" in PmWiki… CVSS 2.0MEDIUM 6.8
  • TI-2010-04385 PmWiki before 2.2.21 has XSS. CVSS 3.1MEDIUM 6.1
  • TI-2006-00465 pmwiki.php in PmWiki 2.1 beta 20, with register_globals enabled, allows remote attackers… CVSS 2.0MEDIUM 4.3
  • TI-2005-03643 Cross-site scripting (XSS) vulnerability in the Search module in PmWiki up to 2.0.12… CVSS 2.0MEDIUM 4.3
  • TI-2010-04471 Cross-site scripting (XSS) vulnerability in pmwiki.php in PmWiki 2.2.20 allows remote… CVSS 2.0MEDIUM 4.3
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences