CVE-2006-3036 EXPLOIT
5.8
MEDIUM · CVSS 2.0 · EPSS 4.3% (pctl 91)
Patch early
A public exploit exists.
Description
Multiple cross-site scripting (XSS) vulnerabilities in 35mmslidegallery 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) imgdir parameter in (a) index.php, and the (2) w, (3) h, and (4) t parameters in (b) popup.php.
Scoring
| CVSS | 5.8 (MEDIUM, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| EPSS | 4.35% — more likely to be exploited than 91% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2006-06-15 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| andy mack | 35mmslidegallery |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Andy Mack 35mm Slide Gallery 6.0 - 'index.php?imgdir' Cross-Site Scripting | 2006-06-13 |
| exploit-db | Andy Mack 35mm Slide Gallery 6.0 - 'popup.php' Multiple Cross-Site Scripting Vulnerabilities | 2006-06-13 |
References
- http://secunia.com/advisories/20652
- http://securityreason.com/securityalert/1100
- http://www.osvdb.org/26507
- http://www.osvdb.org/26508
- http://www.securityfocus.com/archive/1/436959/100/0/threaded
- http://www.securityfocus.com/bid/18414
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27127
- http://secunia.com/advisories/20652
- http://securityreason.com/securityalert/1100
- http://www.osvdb.org/26507
- http://www.osvdb.org/26508
- http://www.securityfocus.com/archive/1/436959/100/0/threaded
- http://www.securityfocus.com/bid/18414
- https://exchange.xforce.ibmcloud.com/vulnerabilities/27127
→ the Explorer · watch your stack · NVD