{"api_version":"1","generated_at":"2026-07-23T10:47:01+00:00","cve":"CVE-2006-4843","urls":{"html":"https://cve.report/CVE-2006-4843","api":"https://cve.report/api/cve/CVE-2006-4843.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-4843","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-4843"},"summary":{"title":"CVE-2006-4843","description":"Cross-site scripting (XSS) vulnerability in the Active Content Filter feature in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to inject arbitrary web script or HTML via unspecified \"code sequences\" that bypass the protection scheme.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-03-29 21:19:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securityfocus.com/bid/23173","name":"http://www.securityfocus.com/bid/23173","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM Lotus Domino Web Access Email Message HTML Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/24633","name":"http://secunia.com/advisories/24633","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"IBM Lotus Domino Script Insertion and Buffer Overflows - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1017824","name":"http://www.securitytracker.com/id?1017824","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - IBM Lotus Domino Web Access Input Validation Hole Permits Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=493","name":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=493","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2007/1133","name":"http://www.vupen.com/english/advisories/2007/1133","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33280","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33280","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www-1.ibm.com/support/docview.wss?uid=swg21257026","name":"http://www-1.ibm.com/support/docview.wss?uid=swg21257026","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM Lotus Domino Web Access Cross-Site Scripting Vulnerability - United States","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-4843","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-4843","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"4843","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_domino","cpe6":"6.5.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4843","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_domino","cpe6":"6.5.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4843","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_domino","cpe6":"6.5.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4843","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_domino","cpe6":"6.5.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4843","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_domino","cpe6":"6.5.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4843","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_domino","cpe6":"6.5.4","cpe7":"*","cpe8":"fp1","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4843","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_domino","cpe6":"6.5.4","cpe7":"*","cpe8":"fp2","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4843","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_domino","cpe6":"6.5.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4843","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_domino","cpe6":"6.5.5","cpe7":"*","cpe8":"fp1","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4843","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_domino","cpe6":"6.5.5","cpe7":"*","cpe8":"fp2","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4843","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_domino","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4843","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_domino","cpe6":"7.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"4843","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"lotus_domino","cpe6":"7.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T19:23:41.311Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"domino-webaccess-contentfilter-xss(33280)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33280"},{"name":"20070328 IBM Lotus Domino Web Access Cross Site Scripting Vulnerability","tags":["third-party-advisory","x_refsource_IDEFENSE","x_transferred"],"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=493"},{"name":"1017824","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1017824"},{"name":"23173","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/23173"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www-1.ibm.com/support/docview.wss?uid=swg21257026"},{"name":"24633","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/24633"},{"name":"ADV-2007-1133","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/1133"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-03-27T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the Active Content Filter feature in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to inject arbitrary web script or HTML via unspecified \"code sequences\" that bypass the protection scheme."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-19T15:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"domino-webaccess-contentfilter-xss(33280)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33280"},{"name":"20070328 IBM Lotus Domino Web Access Cross Site Scripting Vulnerability","tags":["third-party-advisory","x_refsource_IDEFENSE"],"url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=493"},{"name":"1017824","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1017824"},{"name":"23173","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/23173"},{"tags":["x_refsource_CONFIRM"],"url":"http://www-1.ibm.com/support/docview.wss?uid=swg21257026"},{"name":"24633","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/24633"},{"name":"ADV-2007-1133","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/1133"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-4843","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the Active Content Filter feature in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to inject arbitrary web script or HTML via unspecified \"code sequences\" that bypass the protection scheme."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"domino-webaccess-contentfilter-xss(33280)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/33280"},{"name":"20070328 IBM Lotus Domino Web Access Cross Site Scripting Vulnerability","refsource":"IDEFENSE","url":"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=493"},{"name":"1017824","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1017824"},{"name":"23173","refsource":"BID","url":"http://www.securityfocus.com/bid/23173"},{"name":"http://www-1.ibm.com/support/docview.wss?uid=swg21257026","refsource":"CONFIRM","url":"http://www-1.ibm.com/support/docview.wss?uid=swg21257026"},{"name":"24633","refsource":"SECUNIA","url":"http://secunia.com/advisories/24633"},{"name":"ADV-2007-1133","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/1133"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-4843","datePublished":"2007-03-29T21:00:00.000Z","dateReserved":"2006-09-15T00:00:00.000Z","dateUpdated":"2024-08-07T19:23:41.311Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-03-29 21:19:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_domino:6.5.0:*:*:*:*:*:*:*","matchCriteriaId":"0766C3F9-D2A2-4A58-9FF7-11B57232DEA0"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_domino:6.5.1:*:*:*:*:*:*:*","matchCriteriaId":"C00B8057-26DF-4064-A934-0AA88A0C1A6F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_domino:6.5.2:*:*:*:*:*:*:*","matchCriteriaId":"8EFA5487-2D61-4E61-98A3-51882A8CE0C4"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_domino:6.5.3:*:*:*:*:*:*:*","matchCriteriaId":"A95404CC-47B8-40C6-BCED-FC3E68CA8D8F"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_domino:6.5.4:*:*:*:*:*:*:*","matchCriteriaId":"8F342FD1-7A60-4E7D-B56A-E1C3D560C728"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_domino:6.5.4:*:fp1:*:*:*:*:*","matchCriteriaId":"99E2CC18-4049-470A-B6DB-580C65FED0A0"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_domino:6.5.4:*:fp2:*:*:*:*:*","matchCriteriaId":"2396543F-1507-493C-B57F-3082D6E68894"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_domino:6.5.5:*:*:*:*:*:*:*","matchCriteriaId":"C709D66D-3AE7-48B7-9E27-5D1FE452643C"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_domino:6.5.5:*:fp1:*:*:*:*:*","matchCriteriaId":"7B0B5F96-0762-45D3-B13E-1E4ED04AD69D"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_domino:6.5.5:*:fp2:*:*:*:*:*","matchCriteriaId":"DB1EA406-6488-46C0-B857-0BFFAA65B258"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_domino:7.0:*:*:*:*:*:*:*","matchCriteriaId":"8FDDB5FD-9152-4A9C-829B-8BA2ACB3A5A1"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_domino:7.0.1:*:*:*:*:*:*:*","matchCriteriaId":"A8A7AF44-125F-4760-8370-34B7B4CB8753"},{"vulnerable":true,"criteria":"cpe:2.3:a:ibm:lotus_domino:7.0.2:*:*:*:*:*:*:*","matchCriteriaId":"69495B18-39A4-443F-A724-F713C4DD14A2"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"4843","Ordinal":"1","Title":"CVE-2006-4843","CVE":"CVE-2006-4843","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"4843","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the Active Content Filter feature in IBM Lotus Domino before 6.5.6 and 7.x before 7.0.2 FP1 allows remote attackers to inject arbitrary web script or HTML via unspecified \"code sequences\" that bypass the protection scheme.","Type":"Description","Title":"CVE-2006-4843"},{"CveYear":"2006","CveId":"4843","Ordinal":"2","NoteData":"2007-03-29","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"4843","Ordinal":"3","NoteData":"2017-07-19","Type":"Other","Title":"Modified"}]}}}