CVE-2006-1407

23Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendepss 2.5%

from disclosure to weapon0 days

Published on NVDMar 28

1st PoCMar 27

exploitation probability

2.5%top 17% of all CVEs

observed exploitation

nono source reports it

2 public exploit(s)

Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) txtDomainName parameter to domains.asp or (2) SearchText or (3) UserLevel parameters to default.asp.

Affected products

n/a · n/a

public PoCs found — 2✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/27487 exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/27486

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://attrition.org/pipermail/vim/2006-March/000654.html http://pridels0.blogspot.com/2006/03/helm-web-hosting-control-panel-xss.html http://secunia.com/advisories/19375 https://exchange.xforce.ibmcloud.com/vulnerabilities/25470 https://exchange.xforce.ibmcloud.com/vulnerabilities/30309 http://www.osvdb.org/24125 http://www.osvdb.org/24126 http://www.securityfocus.com/bid/17263 http://www.vupen.com/english/advisories/2006/1093