{"api_version":"1","generated_at":"2026-07-23T09:13:19+00:00","cve":"CVE-2006-7233","urls":{"html":"https://cve.report/CVE-2006-7233","api":"https://cve.report/api/cve/CVE-2006-7233.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-7233","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-7233"},"summary":{"title":"CVE-2006-7233","description":"Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.6.0, and possibly other versions before 3.5.3, allows remote attackers to inject arbitrary web script or HTML via the url parameter.","state":"PUBLISHED","assigner":"mitre","published_at":"2006-12-31 05:00:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44459","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44459","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.igniterealtime.org/issues/browse/JM-629","name":"http://www.igniterealtime.org/issues/browse/JM-629","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[#JM-629] Additional cross-site scripting bugs in login - Jive Software Open Source","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/30696","name":"http://www.securityfocus.com/bid/30696","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Openfire 'login.jsp' Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.igniterealtime.org/issues/browse/JM-430","name":"http://www.igniterealtime.org/issues/browse/JM-430","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[#JM-430] Cross-site scripting attack in the login form - Jive Software Open Source","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/47448","name":"http://www.osvdb.org/47448","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/31483","name":"http://secunia.com/advisories/31483","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Openfire \"url\" Cross-Site Scripting Vulnerability - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-7233","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-7233","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"7233","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ignite_realtime","cpe5":"openfire","cpe6":"2.6.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"7233","vulnerable":"1","versionEndIncluding":"3.5.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ignite_realtime","cpe5":"openfire","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T20:57:40.672Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"openfire-login-xss(44459)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44459"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.igniterealtime.org/issues/browse/JM-629"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.igniterealtime.org/issues/browse/JM-430"},{"name":"47448","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/47448"},{"name":"30696","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/30696"},{"name":"31483","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/31483"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-01-17T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.6.0, and possibly other versions before 3.5.3, allows remote attackers to inject arbitrary web script or HTML via the url parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-07T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"openfire-login-xss(44459)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44459"},{"tags":["x_refsource_MISC"],"url":"http://www.igniterealtime.org/issues/browse/JM-629"},{"tags":["x_refsource_MISC"],"url":"http://www.igniterealtime.org/issues/browse/JM-430"},{"name":"47448","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/47448"},{"name":"30696","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/30696"},{"name":"31483","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/31483"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-7233","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.6.0, and possibly other versions before 3.5.3, allows remote attackers to inject arbitrary web script or HTML via the url parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"openfire-login-xss(44459)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/44459"},{"name":"http://www.igniterealtime.org/issues/browse/JM-629","refsource":"MISC","url":"http://www.igniterealtime.org/issues/browse/JM-629"},{"name":"http://www.igniterealtime.org/issues/browse/JM-430","refsource":"MISC","url":"http://www.igniterealtime.org/issues/browse/JM-430"},{"name":"47448","refsource":"OSVDB","url":"http://www.osvdb.org/47448"},{"name":"30696","refsource":"BID","url":"http://www.securityfocus.com/bid/30696"},{"name":"31483","refsource":"SECUNIA","url":"http://secunia.com/advisories/31483"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-7233","datePublished":"2008-08-14T22:00:00.000Z","dateReserved":"2008-08-14T00:00:00.000Z","dateUpdated":"2024-08-07T20:57:40.672Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-12-31 05:00:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ignite_realtime:openfire:*:*:*:*:*:*:*:*","versionEndIncluding":"3.5.2","matchCriteriaId":"6B933493-2E7E-4EC3-BC70-C27076033C86"},{"vulnerable":true,"criteria":"cpe:2.3:a:ignite_realtime:openfire:2.6.0:*:*:*:*:*:*:*","matchCriteriaId":"530BD930-529B-48C1-B3F1-D968115DCEE0"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"7233","Ordinal":"1","Title":"CVE-2006-7233","CVE":"CVE-2006-7233","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"7233","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the login form (login.jsp) of the admin console in Openfire (formerly Wildfire) 2.6.0, and possibly other versions before 3.5.3, allows remote attackers to inject arbitrary web script or HTML via the url parameter.","Type":"Description","Title":"CVE-2006-7233"},{"CveYear":"2006","CveId":"7233","Ordinal":"2","NoteData":"2008-08-14","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"7233","Ordinal":"3","NoteData":"2017-08-07","Type":"Other","Title":"Modified"}]}}}