$ cve CVE-2006-3109 JSON

CVE-2006-3109 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 13.7% (pctl 96)

Patch early

A public exploit exists.

Description

Cross-site scripting (XSS) vulnerability in Cisco CallManager 3.3 before 3.3(5)SR3, 4.1 before 4.1(3)SR4, 4.2 before 4.2(3), and 4.3 before 4.3(1), allows remote attackers to inject arbitrary web script or HTML via the (1) pattern parameter in ccmadmin/phonelist.asp and (2) arbitrary parameters in ccmuser/logon.asp, aka bugid CSCsb68657.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	13.73% — more likely to be exploited than 96% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-06-21
Last modified	2026-06-16

Affected (1)

Vendor	Product
cisco	call manager

Public exploits

Source	Title	Date
exploit-db	Cisco CallManager 3.x/4.x - 'Web Interface 'ccmadmin/phonelist.asp?Pattern' Cross-Site Scripting	2006-06-19
exploit-db	Cisco CallManager 3.x/4.x - 'Web Interface 'ccmuser/logon.asp' Cross-Site Scripting	2006-06-19

References

→ the Explorer · watch your stack · NVD