$ cve CVE-2006-1965 JSON

CVE-2006-1965 EXPLOIT

5.8

MEDIUM · CVSS 2.0 · EPSS 2.5% (pctl 84)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in aasi media Net Clubs Pro 4.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) onuser, (2) pass, (3) chatsys, (4) room, (5) username, and (6) to parameters in (a) sendim.cgi; the (7) username parameter in (b) imessage.cgi; the (8) password parameter in (c) login.cgi; and the (9) cat_id parameter in (d) viewcat.cgi.

Scoring

CVSS	5.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:N
EPSS	2.47% — more likely to be exploited than 84% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-04-21
Last modified	2026-06-16

Affected (1)

Vendor	Product
aasi media	net clubs pro

Public exploits

Source	Title	Date
exploit-db	Net Clubs Pro 4.0 - 'sendim.cgi' Multiple Cross-Site Scripting Vulnerabilities	2006-04-20
exploit-db	Net Clubs Pro 4.0 - 'imessage.cgi?Username' Cross-Site Scripting	2006-04-20
exploit-db	Net Clubs Pro 4.0 - 'login.cgi?Password' Cross-Site Scripting	2006-04-20

References

→ the Explorer · watch your stack · NVD