{"api_version":"1","generated_at":"2026-07-23T09:16:18+00:00","cve":"CVE-2006-3533","urls":{"html":"https://cve.report/CVE-2006-3533","api":"https://cve.report/api/cve/CVE-2006-3533.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-3533","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-3533"},"summary":{"title":"CVE-2006-3533","description":"Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) fg, (2) line1, (3) line2, (4) bg, (5) c1, (6) c2, (7) c3, and (8) c4 parameters in (a) includes/blogroll.php; (9) name and (10) js_name parameters in (b) includes/editor/edit_menu.php; and, even if register_globals is not enabled, the (11) h and (12) w parameters in (c) includes/photo.php.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2006-07-12 21:05:00","updated_at":"2018-10-18 16:47:00"},"problem_types":["NVD-CWE-Other"],"metrics":[],"references":[{"url":"http://securityreason.com/securityalert/1214","name":"1214","refsource":"SREASON","tags":[],"title":"SecurityReason - Pivot <=1.30rc2 privilege escalation / remote commands execution","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/27128","name":"27128","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/18881","name":"18881","refsource":"BID","tags":["Exploit"],"title":"Pivot Multiple Input Validation Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.vupen.com/english/advisories/2006/2744","name":"ADV-2006-2744","refsource":"VUPEN","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27672","name":"pivot-multiple-scripts-xss(27672)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/27127","name":"27127","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/20962","name":"20962","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"Pivot Multiple Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/439495/100/0/threaded","name":"20060707 Pivot <=1.30rc2 privilege escalation / remote commands execution","refsource":"BUGTRAQ","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://retrogod.altervista.org/pivot_130RC2_xpl.html","name":"http://retrogod.altervista.org/pivot_130RC2_xpl.html","refsource":"MISC","tags":["Exploit"],"title":"Error 404 :(","mime":"text/plain","httpstatus":"404","archivestatus":"200"},{"url":"http://www.osvdb.org/27129","name":"27129","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-3533","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-3533","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"3533","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"pivot","cpe5":"pivot","cpe6":"1.30_rc2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3533","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"pivot","cpe5":"pivot","cpe6":"1.30_rc2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-3533","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) fg, (2) line1, (3) line2, (4) bg, (5) c1, (6) c2, (7) c3, and (8) c4 parameters in (a) includes/blogroll.php; (9) name and (10) js_name parameters in (b) includes/editor/edit_menu.php; and, even if register_globals is not enabled, the (11) h and (12) w parameters in (c) includes/photo.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20060707 Pivot <=1.30rc2 privilege escalation / remote commands execution","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/439495/100/0/threaded"},{"name":"pivot-multiple-scripts-xss(27672)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27672"},{"name":"http://retrogod.altervista.org/pivot_130RC2_xpl.html","refsource":"MISC","url":"http://retrogod.altervista.org/pivot_130RC2_xpl.html"},{"name":"ADV-2006-2744","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/2744"},{"name":"27128","refsource":"OSVDB","url":"http://www.osvdb.org/27128"},{"name":"20962","refsource":"SECUNIA","url":"http://secunia.com/advisories/20962"},{"name":"18881","refsource":"BID","url":"http://www.securityfocus.com/bid/18881"},{"name":"1214","refsource":"SREASON","url":"http://securityreason.com/securityalert/1214"},{"name":"27129","refsource":"OSVDB","url":"http://www.osvdb.org/27129"},{"name":"27127","refsource":"OSVDB","url":"http://www.osvdb.org/27127"}]}},"nvd":{"publishedDate":"2006-07-12 21:05:00","lastModifiedDate":"2018-10-18 16:47:00","problem_types":["NVD-CWE-Other"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":5.8},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":4.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:pivot:pivot:1.30_rc2:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"3533","Ordinal":"18858","Title":"CVE-2006-3533","CVE":"CVE-2006-3533","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"3533","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in Pivot 1.30 RC2 and earlier, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) fg, (2) line1, (3) line2, (4) bg, (5) c1, (6) c2, (7) c3, and (8) c4 parameters in (a) includes/blogroll.php; (9) name and (10) js_name parameters in (b) includes/editor/edit_menu.php; and, even if register_globals is not enabled, the (11) h and (12) w parameters in (c) includes/photo.php.","Type":"Description","Title":null},{"CveYear":"2006","CveId":"3533","Ordinal":"2","NoteData":"2006-07-12","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"3533","Ordinal":"3","NoteData":"2018-10-18","Type":"Other","Title":"Modified"}]}}}