CVE-2006-4704

Cross-zone scripting vulnerability in the WMI Object Broker (WMIScriptUtils.WMIObjectBroker2)...

6.8 MediumPublic exploit

Cross-zone scripting vulnerability in the WMI Object Broker (WMIScriptUtils.WMIObjectBroker2) ActiveX control (WmiScriptUtils.dll) in Microsoft Visual Studio 2005 allows remote attackers to bypass Internet zone restrictions and execute arbitrary code by instantiating dangerous objects, aka "WMI Object Broker Vulnerability."

Exploit likelihood

45.6%Down 1.1 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2006-4704
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

Record: CVE-2006-4704
Updated: 2026-11-02

EUVDEUVD-2006-4691 No score

Record: EUVD-2006-4691
Updated: 2026-11-03

GitHub AdvisoriesGHSA-c2c7-569v-pv4f No score

Cross-zone scripting vulnerability in the WMI Object Broker (WMIScriptUtils.WMIObjectBroker2)...

Record: GHSA-c2c7-569v-pv4f
Updated: 2026-11-02

Affected products

microsoft visual studio .net

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Microsoft Internet Explorer - COM CreateObject Code Execution (MS06-014/MS06-073) (Metasploit)	2010-09-20
Metasploit	MS06-014 Microsoft Internet Explorer COM CreateObject Code Execution	2006-04-11

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-4704 is a medium vulnerability (CVSS 6.8) in Microsoft Visual Studio .net, published November 1, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 45.6%, the 98th percentile. No source names a fixed version.

References

Show 13 moreShow less