CVE-2006-3366

LOW 2.6CVE-2006-3366 · Published 06/07/2006 · updated 16/06/2026

In short

CVE-2006-3366 is a LOW (CVSS 2.6) vulnerability affecting v3 chat (v3 chat).
Chance of exploitation in the next 30 days (EPSS): 1.9%, higher than 79.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
v3 chat v3_chat	`= beta`	No fix yet

Description

Multiple cross-site scripting (XSS) vulnerabilities in V3 Chat allow remote attackers to inject arbitrary web script or HTML via crafted HTML tags, as demonstrated by the IMG tag, in the (1) id parameter in (a) mail/index.php and (b) mail/reply.php; (2) login_id parameter in (c) members/is_online.php; (3) site_id parameter in (d) messenger/online.php, (e) messenger/search.php, and (f) messenger/profile.php; (4) contact_name parameter in messenger/search.php; (5) membername parameter in (g) messenger/profileview.php; (6) unspecified parameters used when "editing a profile"; and (7) cust_name parameter in (h) messenger/expire.php. NOTE: The vendor disputes the vectors involving files in the messenger directory, stating "... the referenced folder 'messenger' was never available to the general public...".

References

More vulnerabilities in v3 chat

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free