CVE-2006-2178
Multiple cross-site scripting (XSS) vulnerabilities in CyberBuild allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to login.asp, (2) ProductIndex parameter to browse0.htm, (3) rowcolor parameter to…
Does this matter?
Lower severity and a low EPSS score (1.54%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in CyberBuild allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to login.asp, (2) ProductIndex parameter to browse0.htm, (3) rowcolor parameter to result.asp, or (4) heading parameter to result.asp. NOTE: vectors 1 and 2 might be resultant from SQL injection.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
- EPSS
- 1.54% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- smartwin technology/cyberoffice warehouse builder
- Source
- cve@mitre.org
References
- http://pridels0.blogspot.com/2006/05/cyberbuild-vuln.html
- http://secunia.com/advisories/19889Vendor Advisory
- http://www.osvdb.org/25197Exploit
- http://www.osvdb.org/25198Exploit
- http://www.osvdb.org/25199Exploit
- http://www.securityfocus.com/bid/17829Exploit
- http://www.vupen.com/english/advisories/2006/1630Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26202
- http://pridels0.blogspot.com/2006/05/cyberbuild-vuln.html
- http://secunia.com/advisories/19889Vendor Advisory
- http://www.osvdb.org/25197Exploit
- http://www.osvdb.org/25198Exploit
- http://www.osvdb.org/25199Exploit
- http://www.securityfocus.com/bid/17829Exploit
- http://www.vupen.com/english/advisories/2006/1630Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26202
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.