CVE-2006-3014

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 30.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-06-22 · updated 2026-09-23
Weakness: CWE-20

Description

Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet.

Affected products

Microsoft Excel 2013 Service Pack 1: all versions

References

http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0414.html
http://hackingspirits.com/vuln-rnd/vuln-rnd.html
http://secunia.com/advisories/21865
http://secunia.com/advisories/22882
http://securitytracker.com/id?1016344
http://www.adobe.com/support/security/bulletins/apsb06-11.html
http://www.securiteam.com/windowsntfocus/5TP0M0KIUA.html
http://www.securityfocus.com/bid/18583
http://www.securityfocus.com/bid/19980
http://www.us-cert.gov/cas/techalerts/TA06-318A.html
http://www.vupen.com/english/advisories/2006/3573
http://www.vupen.com/english/advisories/2006/3577

Get alerted when CVE-2006-3014 or the next vulnerability affects your stack