{"api_version":"1","generated_at":"2026-07-23T07:38:04+00:00","cve":"CVE-2006-3377","urls":{"html":"https://cve.report/CVE-2006-3377","api":"https://cve.report/api/cve/CVE-2006-3377.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-3377","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-3377"},"summary":{"title":"CVE-2006-3377","description":"Cross-site scripting (XSS) vulnerability in JMB Software AutoRank PHP 3.02 and earlier, and AutoRank Pro 5.01 and earlier, allows remote attackers to inject arbitrary web script or HTML via the (1) Keyword parameter in search.php and the (2) Username parameter in main.cgi.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2006-07-06 20:05:00","updated_at":"2018-10-18 16:47:00"},"problem_types":["NVD-CWE-Other"],"metrics":[],"references":[{"url":"http://www.vupen.com/english/advisories/2006/2658","name":"ADV-2006-2658","refsource":"VUPEN","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/20929","name":"20929","refsource":"SECUNIA","tags":[],"title":"Secunia - Advisories - AutoRank PHP \"Keyword\" Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27552","name":"autorankpro-adminmain-xss(27552)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/18796","name":"18796","refsource":"BID","tags":[],"title":"AutoRank Multiple Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.majorsecurity.de/advisory/major_rls19.txt","name":"http://www.majorsecurity.de/advisory/major_rls19.txt","refsource":"MISC","tags":[],"title":"majorsecurity.de","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/20903","name":"20903","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"Secunia - Advisories - AutoRank Pro \"Username\" Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1016428","name":"1016428","refsource":"SECTRACK","tags":[],"title":"SecurityTracker.com Archives - AutoRank Pro Input Validation Flaws in 'search.php' and 'main.cgi' Permit Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/2659","name":"ADV-2006-2659","refsource":"VUPEN","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/438941/100/0/threaded","name":"20060702 [MajorSecurity #19] AutoRank <= 5.01 - Multiple XSS and cookie disclosure","refsource":"BUGTRAQ","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1016429","name":"1016429","refsource":"SECTRACK","tags":[],"title":"SecurityTracker.com Archives - AutoRank PHP Input Validation Flaws in 'search.php' and 'main.cgi' Permit Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-3377","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-3377","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"3377","vulnerable":"1","versionEndIncluding":"php_3.02","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jmb_software","cpe5":"autorank","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3377","vulnerable":"1","versionEndIncluding":"pro_5.01","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"jmb_software","cpe5":"autorank","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-3377","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in JMB Software AutoRank PHP 3.02 and earlier, and AutoRank Pro 5.01 and earlier, allows remote attackers to inject arbitrary web script or HTML via the (1) Keyword parameter in search.php and the (2) Username parameter in main.cgi."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"ADV-2006-2658","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/2658"},{"name":"20060702 [MajorSecurity #19] AutoRank <= 5.01 - Multiple XSS and cookie disclosure","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/438941/100/0/threaded"},{"name":"1016428","refsource":"SECTRACK","url":"http://securitytracker.com/id?1016428"},{"name":"20929","refsource":"SECUNIA","url":"http://secunia.com/advisories/20929"},{"name":"http://www.majorsecurity.de/advisory/major_rls19.txt","refsource":"MISC","url":"http://www.majorsecurity.de/advisory/major_rls19.txt"},{"name":"20903","refsource":"SECUNIA","url":"http://secunia.com/advisories/20903"},{"name":"ADV-2006-2659","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/2659"},{"name":"1016429","refsource":"SECTRACK","url":"http://securitytracker.com/id?1016429"},{"name":"18796","refsource":"BID","url":"http://www.securityfocus.com/bid/18796"},{"name":"autorankpro-adminmain-xss(27552)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27552"}]}},"nvd":{"publishedDate":"2006-07-06 20:05:00","lastModifiedDate":"2018-10-18 16:47:00","problem_types":["NVD-CWE-Other"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:H/Au:N/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"HIGH","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":4.9,"impactScore":4.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:jmb_software:autorank:*:*:*:*:*:*:*:*","versionEndIncluding":"pro_5.01","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:jmb_software:autorank:*:*:*:*:*:*:*:*","versionEndIncluding":"php_3.02","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"3377","Ordinal":"18702","Title":"CVE-2006-3377","CVE":"CVE-2006-3377","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"3377","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in JMB Software AutoRank PHP 3.02 and earlier, and AutoRank Pro 5.01 and earlier, allows remote attackers to inject arbitrary web script or HTML via the (1) Keyword parameter in search.php and the (2) Username parameter in main.cgi.","Type":"Description","Title":null},{"CveYear":"2006","CveId":"3377","Ordinal":"2","NoteData":"2006-07-06","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"3377","Ordinal":"3","NoteData":"2018-10-18","Type":"Other","Title":"Modified"}]}}}