{"api_version":"1","generated_at":"2026-07-24T19:37:29+00:00","cve":"CVE-2006-3436","urls":{"html":"https://cve.report/CVE-2006-3436","api":"https://cve.report/api/cve/CVE-2006-3436.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-3436","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-3436"},"summary":{"title":"CVE-2006-3436","description":"Cross-site scripting (XSS) vulnerability in Microsoft .NET Framework 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving \"ASP.NET controls that set the AutoPostBack property to true\".","state":"PUBLISHED","assigner":"microsoft","published_at":"2006-10-10 21:07:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/20337","name":"http://www.securityfocus.com/bid/20337","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft ASP.NET AutoPostBack Variable Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securityfocus.com/archive/1/449179/100/0/threaded","name":"http://www.securityfocus.com/archive/1/449179/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.kb.cert.org/vuls/id/455604","name":"http://www.kb.cert.org/vuls/id/455604","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["US Government Resource"],"title":"US-CERT Vulnerability Note VU#455604","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28658","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28658","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A377","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A377","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/3976","name":"http://www.vupen.com/english/advisories/2006/3976","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1017029","name":"http://securitytracker.com/id?1017029","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - ASP.NET Input Validation Hole in AutoPostBack Feature Permits Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/22307","name":"http://secunia.com/advisories/22307","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Microsoft .NET Framework Cross-Site Scripting Vulnerability - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-056","name":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-056","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft Security Bulletin MS06-056 - Moderate | Microsoft Docs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-3436","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-3436","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"3436","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":".net_framework","cpe6":"2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T18:30:33.702Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20337","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/20337"},{"name":"SSRT061264","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://www.securityfocus.com/archive/1/449179/100/0/threaded"},{"name":"ADV-2006-3976","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2006/3976"},{"name":"1017029","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1017029"},{"name":"VU#455604","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred"],"url":"http://www.kb.cert.org/vuls/id/455604"},{"name":"asp-http-xss(28658)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28658"},{"name":"MS06-056","tags":["vendor-advisory","x_refsource_MS","x_transferred"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-056"},{"name":"HPSBST02161","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://www.securityfocus.com/archive/1/449179/100/0/threaded"},{"name":"22307","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/22307"},{"name":"oval:org.mitre.oval:def:377","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A377"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-10-10T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in Microsoft .NET Framework 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving \"ASP.NET controls that set the AutoPostBack property to true\"."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-18T14:57:01.000Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":"20337","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/20337"},{"name":"SSRT061264","tags":["vendor-advisory","x_refsource_HP"],"url":"http://www.securityfocus.com/archive/1/449179/100/0/threaded"},{"name":"ADV-2006-3976","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2006/3976"},{"name":"1017029","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1017029"},{"name":"VU#455604","tags":["third-party-advisory","x_refsource_CERT-VN"],"url":"http://www.kb.cert.org/vuls/id/455604"},{"name":"asp-http-xss(28658)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28658"},{"name":"MS06-056","tags":["vendor-advisory","x_refsource_MS"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-056"},{"name":"HPSBST02161","tags":["vendor-advisory","x_refsource_HP"],"url":"http://www.securityfocus.com/archive/1/449179/100/0/threaded"},{"name":"22307","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/22307"},{"name":"oval:org.mitre.oval:def:377","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A377"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secure@microsoft.com","ID":"CVE-2006-3436","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in Microsoft .NET Framework 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving \"ASP.NET controls that set the AutoPostBack property to true\"."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20337","refsource":"BID","url":"http://www.securityfocus.com/bid/20337"},{"name":"SSRT061264","refsource":"HP","url":"http://www.securityfocus.com/archive/1/449179/100/0/threaded"},{"name":"ADV-2006-3976","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/3976"},{"name":"1017029","refsource":"SECTRACK","url":"http://securitytracker.com/id?1017029"},{"name":"VU#455604","refsource":"CERT-VN","url":"http://www.kb.cert.org/vuls/id/455604"},{"name":"asp-http-xss(28658)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28658"},{"name":"MS06-056","refsource":"MS","url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-056"},{"name":"HPSBST02161","refsource":"HP","url":"http://www.securityfocus.com/archive/1/449179/100/0/threaded"},{"name":"22307","refsource":"SECUNIA","url":"http://secunia.com/advisories/22307"},{"name":"oval:org.mitre.oval:def:377","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A377"}]}}}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2006-3436","datePublished":"2006-10-10T21:00:00.000Z","dateReserved":"2006-07-07T00:00:00.000Z","dateUpdated":"2024-08-07T18:30:33.702Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-10-10 21:07:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:.net_framework:2.0:*:*:*:*:*:*:*","matchCriteriaId":"A419F50E-F32C-461C-95D0-978C5351FBAA"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"3436","Ordinal":"1","Title":"CVE-2006-3436","CVE":"CVE-2006-3436","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"3436","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in Microsoft .NET Framework 2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving \"ASP.NET controls that set the AutoPostBack property to true\".","Type":"Description","Title":"CVE-2006-3436"},{"CveYear":"2006","CveId":"3436","Ordinal":"2","NoteData":"2006-10-10","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"3436","Ordinal":"3","NoteData":"2018-10-18","Type":"Other","Title":"Modified"}]}}}