CVE-2006-3636

Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote...

6.8 MediumPublic exploitFix available

Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Exploit likelihood

6.95%Down 14.9 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: CVE-2006-3636
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: CVE-2006-3636
Updated: 2026-11-02

EUVDEUVD-2006-3631 No score

Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: EUVD-2006-3631
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gh24-6437-cg34 No score

Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote...

Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Record: GHSA-gh24-6437-cg34
Updated: 2026-11-02

Affected products

gnu mailman

Affected packages

Affected packages
Package	Affected	Fixed
`mailman` Debian:3.1	before 2.1.5-8sarge5, plus listed versions 2.1.5-82.1.5-8sarge12.1.5-8sarge22.1.5-8sarge3	2.1.5-8sarge5
`mailman` Red Hat:enterprise_linux:3::as	before 3:2.1.5.1-25.rhel3.7	3:2.1.5.1-25.rhel3.7
`mailman-debuginfo` Red Hat:enterprise_linux:3::as	before 3:2.1.5.1-25.rhel3.7	3:2.1.5.1-25.rhel3.7
`mailman` Red Hat:enterprise_linux:3::desktop	before 3:2.1.5.1-25.rhel3.7	3:2.1.5.1-25.rhel3.7
`mailman-debuginfo` Red Hat:enterprise_linux:3::desktop	before 3:2.1.5.1-25.rhel3.7	3:2.1.5.1-25.rhel3.7
`mailman` Red Hat:enterprise_linux:3::es	before 3:2.1.5.1-25.rhel3.7	3:2.1.5.1-25.rhel3.7
`mailman-debuginfo` Red Hat:enterprise_linux:3::es	before 3:2.1.5.1-25.rhel3.7	3:2.1.5.1-25.rhel3.7
`mailman` Red Hat:enterprise_linux:3::ws	before 3:2.1.5.1-25.rhel3.7	3:2.1.5.1-25.rhel3.7
`mailman-debuginfo` Red Hat:enterprise_linux:3::ws	before 3:2.1.5.1-25.rhel3.7	3:2.1.5.1-25.rhel3.7
`mailman` Red Hat:enterprise_linux:4::as	before 3:2.1.5.1-34.rhel4.5	3:2.1.5.1-34.rhel4.5

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`mailman-debuginfo` Red Hat:enterprise_linux:4::as	before 3:2.1.5.1-34.rhel4.5	3:2.1.5.1-34.rhel4.5
`mailman` Red Hat:enterprise_linux:4::desktop	before 3:2.1.5.1-34.rhel4.5	3:2.1.5.1-34.rhel4.5
`mailman-debuginfo` Red Hat:enterprise_linux:4::desktop	before 3:2.1.5.1-34.rhel4.5	3:2.1.5.1-34.rhel4.5
`mailman` Red Hat:enterprise_linux:4::es	before 3:2.1.5.1-34.rhel4.5	3:2.1.5.1-34.rhel4.5
`mailman-debuginfo` Red Hat:enterprise_linux:4::es	before 3:2.1.5.1-34.rhel4.5	3:2.1.5.1-34.rhel4.5
`mailman` Red Hat:enterprise_linux:4::ws	before 3:2.1.5.1-34.rhel4.5	3:2.1.5.1-34.rhel4.5
`mailman-debuginfo` Red Hat:enterprise_linux:4::ws	before 3:2.1.5.1-34.rhel4.5	3:2.1.5.1-34.rhel4.5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Mailman 2.1.x - Multiple Input Validation Vulnerabilities	2006-09-14

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-3636 is a medium vulnerability (CVSS 6.8) in Gnu Mailman, published September 6, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.95%, the 94th percentile. Fixed in mailman 2.1.5-8sarge5.

References

Show 31 moreShow less