{"api_version":"1","generated_at":"2026-07-23T09:42:42+00:00","cve":"CVE-2006-0662","urls":{"html":"https://cve.report/CVE-2006-0662","api":"https://cve.report/api/cve/CVE-2006-0662.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-0662","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-0662"},"summary":{"title":"CVE-2006-0662","description":"Cross-site scripting (XSS) vulnerability in Lotus Domino iNotes Client 6.5.4 allows remote attackers to inject arbitrary web script or HTML via email with attached html files, which are directly rendered in the browser.","state":"PUBLISHED","assigner":"mitre","published_at":"2006-02-13 11:06:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24612","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24612","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/16340","name":"http://secunia.com/advisories/16340","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"IBM Lotus Domino Multiple Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/0499","name":"http://www.vupen.com/english/advisories/2006/0499","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1015610","name":"http://securitytracker.com/id?1015610","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - IBM Domino Web Access Input Validation Flaws Permit Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/23077","name":"http://www.osvdb.org/23077","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229919","name":"http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229919","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM Potential script insertion vulnerabilities in Domino Web Access (DWA) - Deutschland","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/16577","name":"http://www.securityfocus.com/bid/16577","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM Lotus Domino iNotes Multiple HTML and Script Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/secunia_research/2005-38/advisory/","name":"http://secunia.com/secunia_research/2005-38/advisory/","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"IBM Lotus Domino iNotes Client Script Insertion Vulnerabilities - Secunia Research - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-0662","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-0662","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"662","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_domino_inotes_client","cpe6":"6.5.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2006","cve_id":"662","cve":"CVE-2006-0662","epss":"0.005440000","percentile":"0.677850000","score_date":"2026-04-16","updated_at":"2026-04-17 00:09:25"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T16:41:28.983Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://secunia.com/secunia_research/2005-38/advisory/"},{"name":"ADV-2006-0499","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2006/0499"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229919"},{"name":"domino-webaccess-subject-xss(24612)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24612"},{"name":"23077","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/23077"},{"name":"16577","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/16577"},{"name":"16340","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/16340"},{"name":"1015610","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1015610"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-02-10T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in Lotus Domino iNotes Client 6.5.4 allows remote attackers to inject arbitrary web script or HTML via email with attached html files, which are directly rendered in the browser."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-19T15:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://secunia.com/secunia_research/2005-38/advisory/"},{"name":"ADV-2006-0499","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2006/0499"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229919"},{"name":"domino-webaccess-subject-xss(24612)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24612"},{"name":"23077","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/23077"},{"name":"16577","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/16577"},{"name":"16340","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/16340"},{"name":"1015610","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1015610"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-0662","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in Lotus Domino iNotes Client 6.5.4 allows remote attackers to inject arbitrary web script or HTML via email with attached html files, which are directly rendered in the browser."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://secunia.com/secunia_research/2005-38/advisory/","refsource":"MISC","url":"http://secunia.com/secunia_research/2005-38/advisory/"},{"name":"ADV-2006-0499","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/0499"},{"name":"http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229919","refsource":"CONFIRM","url":"http://www-1.ibm.com/support/docview.wss?rs=475&uid=swg21229919"},{"name":"domino-webaccess-subject-xss(24612)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/24612"},{"name":"23077","refsource":"OSVDB","url":"http://www.osvdb.org/23077"},{"name":"16577","refsource":"BID","url":"http://www.securityfocus.com/bid/16577"},{"name":"16340","refsource":"SECUNIA","url":"http://secunia.com/advisories/16340"},{"name":"1015610","refsource":"SECTRACK","url":"http://securitytracker.com/id?1015610"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-0662","datePublished":"2006-02-13T11:00:00.000Z","dateReserved":"2006-02-13T00:00:00.000Z","dateUpdated":"2024-08-07T16:41:28.983Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-02-13 11:06:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_domino_inotes_client:6.5.4:*:*:*:*:*:*:*","matchCriteriaId":"11DD0C18-764C-4B8D-A052-F52613D14ED4"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"662","Ordinal":"1","Title":"CVE-2006-0662","CVE":"CVE-2006-0662","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"662","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in Lotus Domino iNotes Client 6.5.4 allows remote attackers to inject arbitrary web script or HTML via email with attached html files, which are directly rendered in the browser.","Type":"Description","Title":"CVE-2006-0662"},{"CveYear":"2006","CveId":"662","Ordinal":"2","NoteData":"2006-02-13","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"662","Ordinal":"3","NoteData":"2017-07-19","Type":"Other","Title":"Modified"}]}}}