CVE-2006-3014

Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users...

5.1 MediumPublic exploit

Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet.

Exploit likelihood

30.1%Down 18.2 points since Feb 4, 2022

What each source reports

NVD Score used 5.1

Record: CVE-2006-3014
CVSS 2.0: 5.1 MediumAV:N/AC:H/Au:N/C:P/I:P/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2006-3014
Updated: 2026-11-02

EUVDEUVD-2006-3011 No score

Record: EUVD-2006-3011
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4v5q-p386-f6mv No score

Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users...

Record: GHSA-4v5q-p386-f6mv
Weakness: CWE-20
Updated: 2026-11-02

Affected products

microsoft excel

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Microsoft Office 2003 - Embedded Shockwave Flash Object Security Bypass	2006-06-22

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-3014 is a medium vulnerability (CVSS 5.1) in Microsoft Excel, published June 22, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 30.1%, the 98th percentile. No source names a fixed version.

References

Show 12 moreShow less