Vulnerability Details : CVE-2006-3564
Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the email, (2) cond, or (3) name parameters to (a) addressbook.view.php, (4) the daysprune parameter to (b) index.php, (5) the data[to] parameter to (c) compose.email.php, and (6) the markas parameter to (d) read.markas.php.
Vulnerability category: Cross site scripting (XSS)
Exploit prediction scoring system (EPSS) score for CVE-2006-3564
Probability of exploitation activity in the next 30 days: 1.88%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 87 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2006-3564
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
nvd@nist.gov |
References for CVE-2006-3564
Products affected by CVE-2006-3564
- cpe:2.3:a:hivemail:hivemail:1.3:*:*:*:*:*:*:*
- cpe:2.3:a:hivemail:hivemail:1.2:*:*:*:*:*:*:*