CVE-2006-3365
V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter...
CVE-2006-3365 is a low vulnerability (CVSS 2.6) in V3 Chat Chat, published July 6, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.46%, the 73rd percentile. No source names a fixed version.
- Severity
- 2.6 LowCVSS 2.0, NVD
- Exploit chance
- 1.46%EPSS, 73rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter to mail/index.php or (2) membername parameter to messenger/online.php, which displays the path in an error page due to an incorrect SQL statement.
Exploit likelihood
Affected products
What each source reports
NVD Score used
V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter to mail/index.php or (2) membername parameter to messenger/online.php, which displays the path in an error page due to an incorrect SQL statement.
- Record
CVE-2006-3365- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter to mail/index.php or (2) membername parameter to messenger/online.php, which displays the path in an error page due to an incorrect SQL statement.
- Record
CVE-2006-3365- Updated
- 2026-11-02
EUVDEUVD-2006-3361No score
V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter to mail/index.php or (2) membername parameter to messenger/online.php, which displays the path in an error page due to an incorrect SQL statement.
- Record
EUVD-2006-3361- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xxw5-5p2v-w5j9No score
V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter...
V3 Chat allows remote attackers to obtain the installation path via (1) an invalid id parameter to mail/index.php or (2) membername parameter to messenger/online.php, which displays the path in an error page due to an incorrect SQL statement.
- Record
GHSA-xxw5-5p2v-w5j9- Weakness
- CWE-200
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
exchange.xforce.ibmcloud.com/vulnerabilities/27395
securityfocus.com/bid/18543
securitytracker.com/id?1016340
vupen.com/english/advisories/2006/2474
nvd.nist.gov/vuln/detail/CVE-2006-3365
github.com/advisories/GHSA-xxw5-5p2v-w5j9