CVE-2006-3564

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-07-13 · updated 2026-06-16

Description

Multiple cross-site scripting (XSS) vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the email, (2) cond, or (3) name parameters to (a) addressbook.view.php, (4) the daysprune parameter to (b) index.php, (5) the data[to] parameter to (c) compose.email.php, and (6) the markas parameter to (d) read.markas.php.

Affected products

Hivemail: 1.2, 1.3

References

http://pridels0.blogspot.com/2006/07/hivemail-vuln.html
http://secunia.com/advisories/20993
http://securitytracker.com/id?1016531
http://www.osvdb.org/27100
http://www.osvdb.org/27101
http://www.osvdb.org/27102
http://www.osvdb.org/27103
http://www.securityfocus.com/bid/18949
http://www.vupen.com/english/advisories/2006/2763
https://exchange.xforce.ibmcloud.com/vulnerabilities/27695
http://pridels0.blogspot.com/2006/07/hivemail-vuln.html
http://secunia.com/advisories/20993

Get alerted when CVE-2006-3564 or the next vulnerability affects your stack