Analyst readout for executives and security teams
Plain-English summary
This CVE describes cross-site scripting in older Sphider search pages. If an affected search form is exposed, an attacker could cause a visitor’s browser to run attacker-supplied script or render unwanted HTML. The record does not provide a CVSS score and warns that details come only from third-party information.
Executive priority
Treat this as a targeted legacy-asset cleanup item, not a confirmed emergency. Prioritize it if Sphider is internet-facing, used on trusted customer portals, or embedded in authenticated sessions where browser-based attacks could affect users.
Technical view
Sphider versions before 1.3.1c reportedly allow XSS through the catid parameter in templates/standard/search_form.html and templates/dark/search_form.html. The CVE lists no CWE, CPE, or vendor/product metadata, and notes unknown provenance. Treat affected-version evidence cautiously and verify directly against deployed code.
Likely exposure
Exposure is most likely in legacy Sphider deployments before 1.3.1c, especially internet-facing search pages using the standard or dark templates. Modern environments may have no exposure unless this older search package is still embedded in a public site.
Exploitation context
The source bundle does not show active exploitation, and the CVE is not marked as KEV. The vulnerability is remotely reachable through web input, but available evidence is sparse and third-party-derived. Do not assume exploitation without local telemetry or another cited source.
Researcher notes
The main uncertainty is source quality: the CVE explicitly says provenance is unknown and details are from third-party information. No CVSS, CWE, CPE, exploit status, or formal vendor advisory is provided in the bundle. Local code and version validation are essential.
Mitigation direction
- Inventory websites and applications for Sphider usage.
- If present, verify whether the version is before 1.3.1c.
- Move affected Sphider instances to 1.3.1c or later where feasible.
- Review vendor or project guidance before applying compensating changes.
- Restrict or remove unused public search pages.
Validation and detection
- Confirm whether standard or dark Sphider templates are deployed.
- Check rendering paths for proper catid output encoding.
- Review web logs for unusual catid parameter activity.
- Validate remediation in staging with benign input only.
- Document affected URLs, versions, and remediation status.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2006-7058 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- ADV-2006-1845CVE reference · vdb-entry, x_refsource_VUPEN
- 25574CVE reference · vdb-entry, x_refsource_OSVDB
- 20131CVE reference · third-party-advisory, x_refsource_SECUNIA
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.