$ cve CVE-2006-3607 JSON

CVE-2006-3607 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 1.8% (pctl 77)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Banner Exchange Script (aka Banner Exchange Network Script) 1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the city parameter in (a) insertmember.php, and (2) a PHPSESSID cookie in (b) lostpassword.php, (c) gen_confirm_mem.php, and (d) index.php.

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	1.76% — more likely to be exploited than 77% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-07-18
Last modified	2026-06-16

Affected (1)

Vendor	Product
softbizscripts	banner exchange script

Public exploits

Source	Title	Date
exploit-db	SoftBiz Banner Exchange Script 1.0 - 'insertmember.php?city' Cross-Site Scripting	2006-06-29
exploit-db	SoftBiz Banner Exchange Script 1.0 - 'lostpassword.php?PHPSESSID' Cross-Site Scripting	2006-06-29
exploit-db	SoftBiz Banner Exchange Script 1.0 - 'gen_confirm_mem.php?PHPSESSID' Cross-Site Scripting	2006-06-29
exploit-db	SoftBiz Banner Exchange Script 1.0 - 'index.php?PHPSESSID' Cross-Site Scripting	2006-06-29

References

→ the Explorer · watch your stack · NVD