{"api_version":"1","generated_at":"2026-04-25T05:40:18+00:00","cve":"CVE-2006-3607","urls":{"html":"https://cve.report/CVE-2006-3607","api":"https://cve.report/api/cve/CVE-2006-3607.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-3607","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-3607"},"summary":{"title":"CVE-2006-3607","description":"Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Banner Exchange Script (aka Banner Exchange Network Script) 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the city parameter in (a) insertmember.php, and (2) a PHPSESSID cookie in (b) lostpassword.php, (c) gen_confirm_mem.php, and (d) index.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2006-07-18 15:46:00","updated_at":"2026-04-06 14:41:02"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/archive/1/438705/100/200/threaded","name":"http://www.securityfocus.com/archive/1/438705/100/200/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27461","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27461","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27460","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27460","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/18735","name":"http://www.securityfocus.com/bid/18735","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Broken Link"],"title":"Softbiz Banner Exchange Multiple Cross-Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://ellsec.org/print.php?type=N&item_id=141","name":"http://ellsec.org/print.php?type=N&item_id=141","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","URL Repurposed"],"title":"","mime":"","httpstatus":"-1","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-3607","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-3607","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"3607","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"softbizscripts","cpe5":"banner_exchange_script","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2006","cve_id":"3607","cve":"CVE-2006-3607","epss":"0.004360000","percentile":"0.629400000","score_date":"2026-04-07","updated_at":"2026-04-08 00:03:39"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T18:39:52.535Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://ellsec.org/print.php?type=N&item_id=141"},{"name":"18735","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/18735"},{"name":"20060629 Softbiz Banner Exchange 1.0 XSS","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/438705/100/200/threaded"},{"name":"softbizbannerexchange-multiple-xss(27461)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27461"},{"name":"softbizbannerexchange-insertmember-xss(27460)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27460"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-06-29T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Banner Exchange Script (aka Banner Exchange Network Script) 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the city parameter in (a) insertmember.php, and (2) a PHPSESSID cookie in (b) lostpassword.php, (c) gen_confirm_mem.php, and (d) index.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-18T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"tags":["x_refsource_MISC"],"url":"http://ellsec.org/print.php?type=N&item_id=141"},{"name":"18735","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/18735"},{"name":"20060629 Softbiz Banner Exchange 1.0 XSS","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/438705/100/200/threaded"},{"name":"softbizbannerexchange-multiple-xss(27461)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27461"},{"name":"softbizbannerexchange-insertmember-xss(27460)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27460"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-3607","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Banner Exchange Script (aka Banner Exchange Network Script) 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the city parameter in (a) insertmember.php, and (2) a PHPSESSID cookie in (b) lostpassword.php, (c) gen_confirm_mem.php, and (d) index.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"http://ellsec.org/print.php?type=N&item_id=141","refsource":"MISC","url":"http://ellsec.org/print.php?type=N&item_id=141"},{"name":"18735","refsource":"BID","url":"http://www.securityfocus.com/bid/18735"},{"name":"20060629 Softbiz Banner Exchange 1.0 XSS","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/438705/100/200/threaded"},{"name":"softbizbannerexchange-multiple-xss(27461)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27461"},{"name":"softbizbannerexchange-insertmember-xss(27460)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27460"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-3607","datePublished":"2006-07-14T21:00:00.000Z","dateReserved":"2006-07-14T00:00:00.000Z","dateUpdated":"2024-08-07T18:39:52.535Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-07-18 15:46:00","lastModifiedDate":"2026-04-06 14:41:02","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:softbizscripts:banner_exchange_script:1.0:*:*:*:*:*:*:*","matchCriteriaId":"553F203C-29FB-497F-B9B0-A81806CFAC3B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"3607","Ordinal":"1","Title":"CVE-2006-3607","CVE":"CVE-2006-3607","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"3607","Ordinal":"1","NoteData":"Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Banner Exchange Script (aka Banner Exchange Network Script) 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the city parameter in (a) insertmember.php, and (2) a PHPSESSID cookie in (b) lostpassword.php, (c) gen_confirm_mem.php, and (d) index.php.","Type":"Description","Title":"CVE-2006-3607"},{"CveYear":"2006","CveId":"3607","Ordinal":"2","NoteData":"2006-07-14","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"3607","Ordinal":"3","NoteData":"2018-10-18","Type":"Other","Title":"Modified"}]}}}