$ cve CVE-2006-1407 JSON

CVE-2006-1407 EXPLOIT

5.8

MEDIUM · CVSS 2.0 · EPSS 2.5% (pctl 84)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) txtDomainName parameter to domains.asp or (2) SearchText or (3) UserLevel parameters to default.asp.

Scoring

CVSS	5.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:N
EPSS	2.47% — more likely to be exploited than 84% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-03-28
Last modified	2026-06-16

Affected (1)

Vendor	Product
webhost automation	helm web hosting control panel

Public exploits

Source	Title	Date
exploit-db	Web Host Automation Ltd. Helm 3.2.10 Beta - 'domains.asp?txtDomainName' Cross-Site Scripting	2006-03-27
exploit-db	Web Host Automation Ltd. Helm 3.2.10 Beta - 'default.asp' Multiple Cross-Site Scripting Vulnerabilities	2006-03-27

References

→ the Explorer · watch your stack · NVD