CVE-2006-0032
Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP,...
Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.
- Record
CVE-2006-0032- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.
- Record
CVE-2006-0032- Updated
- 2026-11-02
EUVDEUVD-2006-0040 No score
Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.
- Record
EUVD-2006-0040- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j37x-hh95-r628 No score
Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP,...
Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.
- Record
GHSA-j37x-hh95-r628- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft Indexing Service - Query Validation Cross-Site Scripting | 2006-09-12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-0032 is a medium vulnerability (CVSS 4.3) in Microsoft Windows 2000, published September 12, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 24.6%, the 97th percentile. No source names a fixed version.
References
securityfocus.com/archive/1/447509/100/0/threaded
exchange.xforce.ibmcloud.com/vulnerabilities/28651
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A535
vupen.com/english/advisories/2006/3564
kb.cert.org/vuls/id/108884
securitytracker.com/id?1016826
Show 9 moreShow less
us-cert.gov/cas/techalerts/TA06-255A.html
docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-053
geocities.jp/ptrs_sec/advisory09e.html
secunia.com/advisories/21861
nvd.nist.gov/vuln/detail/CVE-2006-0032
github.com/advisories/GHSA-j37x-hh95-r628