{"api_version":"1","generated_at":"2026-07-23T07:48:42+00:00","cve":"CVE-2006-3564","urls":{"html":"https://cve.report/CVE-2006-3564","api":"https://cve.report/api/cve/CVE-2006-3564.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-3564","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-3564"},"summary":{"title":"CVE-2006-3564","description":"Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the email, (2) cond, or (3) name parameters to (a) addressbook.view.php, (4) the daysprune parameter to (b) index.php, (5) the data[to] parameter to (c) compose.email.php, and (6) the markas parameter to (d) read.markas.php.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2006-07-13 01:05:00","updated_at":"2017-07-20 01:32:00"},"problem_types":["NVD-CWE-Other"],"metrics":[],"references":[{"url":"http://www.osvdb.org/27102","name":"27102","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://pridels0.blogspot.com/2006/07/hivemail-vuln.html","name":"http://pridels0.blogspot.com/2006/07/hivemail-vuln.html","refsource":"MISC","tags":[],"title":"- UNSECURED SYSTEMS -: HiveMail vuln.","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/18949","name":"18949","refsource":"BID","tags":[],"title":"HiveMail Multiple Input Validation Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.osvdb.org/27100","name":"27100","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/20993","name":"20993","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"HiveMail Cross-Site Scripting and SQL Injection Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1016531","name":"1016531","refsource":"SECTRACK","tags":[],"title":"SecurityTracker.com Archives - HiveMail Input Validation Holes Permit Cross-Site Scripting and SQL Injection Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/27103","name":"27103","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27101","name":"27101","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.vupen.com/english/advisories/2006/2763","name":"ADV-2006-2763","refsource":"VUPEN","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27695","name":"hivemail-multiple-scripts-xss(27695)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-3564","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-3564","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"3564","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hivemail","cpe5":"hivemail","cpe6":"1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3564","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hivemail","cpe5":"hivemail","cpe6":"1.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3564","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hivemail","cpe5":"hivemail","cpe6":"1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3564","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hivemail","cpe5":"hivemail","cpe6":"1.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-3564","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the email, (2) cond, or (3) name parameters to (a) addressbook.view.php, (4) the daysprune parameter to (b) index.php, (5) the data[to] parameter to (c) compose.email.php, and (6) the markas parameter to (d) read.markas.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"18949","refsource":"BID","url":"http://www.securityfocus.com/bid/18949"},{"name":"27103","refsource":"OSVDB","url":"http://www.osvdb.org/27103"},{"name":"27100","refsource":"OSVDB","url":"http://www.osvdb.org/27100"},{"name":"27101","refsource":"OSVDB","url":"http://www.osvdb.org/27101"},{"name":"hivemail-multiple-scripts-xss(27695)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27695"},{"name":"27102","refsource":"OSVDB","url":"http://www.osvdb.org/27102"},{"name":"ADV-2006-2763","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/2763"},{"name":"1016531","refsource":"SECTRACK","url":"http://securitytracker.com/id?1016531"},{"name":"http://pridels0.blogspot.com/2006/07/hivemail-vuln.html","refsource":"MISC","url":"http://pridels0.blogspot.com/2006/07/hivemail-vuln.html"},{"name":"20993","refsource":"SECUNIA","url":"http://secunia.com/advisories/20993"}]}},"nvd":{"publishedDate":"2006-07-13 01:05:00","lastModifiedDate":"2017-07-20 01:32:00","problem_types":["NVD-CWE-Other"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:hivemail:hivemail:1.2:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:hivemail:hivemail:1.3:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"3564","Ordinal":"18890","Title":"CVE-2006-3564","CVE":"CVE-2006-3564","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"3564","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the email, (2) cond, or (3) name parameters to (a) addressbook.view.php, (4) the daysprune parameter to (b) index.php, (5) the data[to] parameter to (c) compose.email.php, and (6) the markas parameter to (d) read.markas.php.","Type":"Description","Title":null},{"CveYear":"2006","CveId":"3564","Ordinal":"2","NoteData":"2006-07-12","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"3564","Ordinal":"3","NoteData":"2017-07-19","Type":"Other","Title":"Modified"}]}}}