CVE-2006-3155

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-06-22 · updated 2026-06-16

Description

Multiple cross-site scripting (XSS) vulnerabilities in Ultimate Auction 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) item parameter in (a) emailtofriend.pl or (b) violation.pl, (2) seller parameter in (c) vsoa.pl, (3) user parameter in (d) userask.pl or (e) leavefeed.pl, (4) itemnum parameter in userask.pl, (5) category parameter in (f) itemlist.pl, and the (6) query parameter in (g) search.pl.

Affected products

Thinkfactory Ultimate Estate: through 1.0

References

http://pridels0.blogspot.com/2006/06/ultimate-auction-xss-vuln.html
http://securitytracker.com/id?1016351
https://exchange.xforce.ibmcloud.com/vulnerabilities/27276
http://pridels0.blogspot.com/2006/06/ultimate-auction-xss-vuln.html
http://securitytracker.com/id?1016351
https://exchange.xforce.ibmcloud.com/vulnerabilities/27276

Get alerted when CVE-2006-3155 or the next vulnerability affects your stack