CVE-2006-3607

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Banner Exchange Script (aka Banner Exchange Network Script) 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the city parameter in (a) insertmember.php, and (2) a PHPSESSID cookie in (b) lostpassword.php, (c) gen_confirm_mem.php, and (d) index.php.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://ellsec.org/print.php?type=N&item_id=141Exploit, URL Repurposed
http://www.securityfocus.com/archive/1/438705/100/200/threadedBroken Link
http://www.securityfocus.com/bid/18735Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/27460Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27461Third Party Advisory
http://ellsec.org/print.php?type=N&item_id=141Exploit, URL Repurposed
http://www.securityfocus.com/archive/1/438705/100/200/threadedBroken Link
http://www.securityfocus.com/bid/18735Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/27460Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27461Third Party Advisory

Timeline

Published: Jul 18, 2006
Last modified: Jun 16, 2026
NVD status: Analyzed

Related CVEs from 2006

CVE-2006-36084.6The Gallery module in Simone Vellei Flatnuke 2.5.7 and earlier, when Gallery uploads are enabled, does not restrict the extensions of upload CVE-2006-36094.3Cross-site scripting (XSS) vulnerability in index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to inject arbitrary web script CVE-2006-36105.0index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to obtain sensitive information (partial database schema) via a modified pa CVE-2006-36115.5Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via d CVE-2006-36122.6Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vec CVE-2006-36135.8Multiple cross-site scripting (XSS) vulnerabilities in Chamberland Technology ezWaiter 3.0 Online and possibly Enterprise Software (aka ente CVE-2006-36147.5index.php in Orbitcoders OrbitMATRIX 1.0 allows remote attackers to trigger a SQL error via the page_name parameter, possibly due to a SQL i CVE-2006-36155.1Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arb CVE-2006-36164.3Multiple cross-site scripting (XSS) vulnerabilities in Carbonize Lazarus Guestbook 1.6 and earlier allow remote attackers to inject arbitrar CVE-2006-36175.8Cross-site scripting (XSS) vulnerability in pblguestbook.php in Pixelated By Lev (PBL) Guestbook 1.32 and earlier allows remote attackers to CVE-2006-36187.5SQL injection vulnerability in pblguestbook.php in Pixelated By Lev (PBL) Guestbook 1.32 and earlier allows remote attackers to execute arbi CVE-2006-36192.6Directory traversal vulnerability in FastJar 0.93, as used in Gnu GCC 4.1.1 and earlier, and 3.4.6 and earlier, allows user-assisted attacke