$ cve CVE-2006-5983 JSON

CVE-2006-5983 EXPLOIT

6.0

MEDIUM · CVSS 2.0 · EPSS 1.8% (pctl 78)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in JBMC Software DirectAdmin 1.28.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) user parameter to (a) CMD_SHOW_RESELLER or (b) CMD_SHOW_USER in the Admin level; the (2) TYPE parameter to (c) CMD_TICKET_CREATE or (d) CMD_TICKET, the (3) user parameter to (e) CMD_EMAIL_FORWARDER_MODIFY, (f) CMD_EMAIL_VACATION_MODIFY, or (g) CMD_FTP_SHOW, and the (4) name parameter to (h) CMD_EMAIL_LIST in the User level; or the (5) user parameter to (i) CMD_SHOW_USER in the Reseller level.

Scoring

CVSS	6.0 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:S/C:P/I:P/A:P
EPSS	1.77% — more likely to be exploited than 78% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2006-11-20
Last modified	2026-06-16

Affected (1)

Vendor	Product
directadmin	directadmin

Public exploits

Source	Title	Date
exploit-db	DirectAdmin 1.28/1.29 - 'CMD_SHOW_RESELLER' Cross-Site Scripting	2006-11-12
exploit-db	DirectAdmin 1.28/1.29 - 'CMD_SHOW_USER' Cross-Site Scripting	2006-11-12
exploit-db	DirectAdmin 1.28/1.29 - 'CMD_TICKET_CREATE' Cross-Site Scripting	2006-11-12
exploit-db	DirectAdmin 1.28/1.29 - 'CMD_EMAIL_FORWARDER_MODIFY' Cross-Site Scripting	2006-11-12
exploit-db	DirectAdmin 1.28/1.29 - 'CMD_TICKET' Cross-Site Scripting	2006-11-12
exploit-db	DirectAdmin 1.28/1.29 - 'CMD_EMAIL_VACATION_MODIFY' Cross-Site Scripting	2006-11-12
exploit-db	DirectAdmin 1.28/1.29 - 'CMD_EMAIL_LIST' Cross-Site Scripting	2006-11-12
exploit-db	DirectAdmin 1.28/1.29 - 'CMD_FTP_SHOW' Cross-Site Scripting	2006-11-12

References

→ the Explorer · watch your stack · NVD