CVE-2006-2178 json
Multiple cross-site scripting (XSS) vulnerabilities in CyberBuild allow remote attackers to inject arbitrary web script or HTML via the (1)…
published 2006-05-04 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-2179
- cvss
- 5.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 3
- Exploit-DB
Summary
Multiple cross-site scripting (XSS) vulnerabilities in CyberBuild allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to login.asp, (2) ProductIndex parameter to browse0.htm, (3) rowcolor parameter to result.asp, or (4) heading parameter to result.asp. NOTE: vectors 1 and 2 might be resultant from SQL injection.
Timeline
- First public exploit (EDB-27817)
- Published
Exploit prediction
1.57% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-27817 CyberBuild - 'result.asp' Multiple Cross-Site Scripting Vulnerabilities webapps, 2006-05-03
- EDB-27816 CyberBuild - 'browse0.htm?ProductIndex' Cross-Site Scripting webapps, 2006-05-03
- EDB-27815 CyberBuild - 'login.asp?sessionid' Cross-Site Scripting webapps, 2006-05-03
- osvdb.org http://www.osvdb.org/25198 referenced PoC, tagged "exploit" by a source, unverified
- osvdb.org http://www.osvdb.org/25199 referenced PoC, tagged "exploit" by a source, unverified
- osvdb.org http://www.osvdb.org/25197 referenced PoC, tagged "exploit" by a source, unverified
- securityfocus.com http://www.securityfocus.com/bid/17829 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
osvdb.org
/25198
vdb-entry, exploit
-
osvdb.org
/25199
vdb-entry, exploit
-
osvdb.org
/25197
vdb-entry, exploit
-
securityfocus.com
/bid/17829
vdb-entry, exploit
-
vupen.com
/english/advisories/2006/1630
vdb-entry, vendor-advisory
-
secunia.com
/advisories/19889
third-party-advisory, vendor-advisory
- pridels0.blogspot.com /2006/05/cyberbuild-vuln.html
-
exchange.xforce.ibmcloud.com
/vulnerabilities/26202
vdb-entry
Sources
- CVE List CVE-2006-2178
- NVD CVE-2006-2178
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.