$ cve CVE-2006-6158 JSON

CVE-2006-6158 EXPLOIT

6.8

MEDIUM · CVSS 2.0 · EPSS 2.9% (pctl 86)

Patch early

A public exploit exists.

Description

Multiple cross-site scripting (XSS) vulnerabilities in (a) PMOS Help Desk 2.4, formerly (b) InverseFlow Help Desk 2.31 and also sold as (c) Ace Helpdesk 2.31, allow remote attackers to inject arbitrary web script or HTML via the (1) id or email parameter to ticketview.php, or (2) the email parameter to ticket.php.

Scoring

CVSS	6.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS	2.87% — more likely to be exploited than 86% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-11-28
Last modified	2026-06-16

Affected (3)

Vendor	Product
ace helpdesk	ace helpdesk
inverseflow	help desk
pmos helpdesk	pmos helpdesk

Public exploits

Source	Title	Date
exploit-db	PMOS Help Desk 2.3 - 'ticketview.php' Multiple Cross-Site Scripting Vulnerabilities	2006-11-22
exploit-db	PMOS Help Desk 2.3 - 'ticket.php?email' Cross-Site Scripting	2006-11-22

References

→ the Explorer · watch your stack · NVD