CVE-2006-1486 json
Multiple cross-site scripting (XSS) vulnerabilities in index.cfm in realestateZONE 4.2 allow remote attackers to inject arbitrary web scrip…
published 2006-03-29 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-1490
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.9%
- EPSS 3.9% chance of exploitation in 30 days, percentile 90%
- public exploits
- 1
- Exploit-DB
Summary
Multiple cross-site scripting (XSS) vulnerabilities in index.cfm in realestateZONE 4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) bamin, (2) bemin, (3) pmin, and (4) state parameters.
Timeline
- First public exploit (EDB-27493)
- Published
Exploit prediction
3.88% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-27493 RealestateZONE 4.2 - Multiple Cross-Site Scripting Vulnerabilities webapps, 2006-03-28
- secunia.com http://secunia.com/advisories/19429 referenced PoC, tagged "exploit" by a source, unverified
- securityfocus.com http://www.securityfocus.com/bid/17277 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
References
-
secunia.com
/advisories/19429
third-party-advisory, exploit, vendor-advisory
-
securityfocus.com
/bid/17277
vdb-entry, exploit
-
osvdb.org
/24186
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/25487
vdb-entry
-
vupen.com
/english/advisories/2006/1128
vdb-entry
- pridels0.blogspot.com /2006/03/realestatezone-42-multiple-xss-vuln.html
Sources
- CVE List CVE-2006-1486
- NVD CVE-2006-1486
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.