{"id":"CVE-2006-3036","aliases":["EUVD-2006-3033","GHSA-gqxc-7qg9-p46c"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in 35mmslidegallery 6.0 allow remote...","description":"Multiple cross-site scripting (XSS) vulnerabilities in 35mmslidegallery 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) imgdir parameter in (a) index.php, and the (2) w, (3) h, and (4) t parameters in (b) popup.php.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04348,"percentile":0.91293,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2006-06-15T10:00:00Z","modified":"2026-06-16T22:26:16Z","exploits":[{"source":"exploitdb","id":"EDB-28020","title":"Andy Mack 35mm Slide Gallery 6.0 - 'index.php?imgdir' Cross-Site Scripting","type":"webapps","platform":"php","date":"2006-06-13","verified":true,"url":"https://www.exploit-db.com/exploits/28020"},{"source":"exploitdb","id":"EDB-28021","title":"Andy Mack 35mm Slide Gallery 6.0 - 'popup.php' Multiple Cross-Site Scripting Vulnerabilities","type":"webapps","platform":"php","date":"2006-06-13","verified":true,"url":"https://www.exploit-db.com/exploits/28021"}],"products":[{"vendor":"andy_mack","product":"35mmslidegallery"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/27127","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.osvdb.org/26508","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/18414","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit"]},{"url":"http://securityreason.com/securityalert/1100","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"]},{"url":"http://secunia.com/advisories/20652","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/436959/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.osvdb.org/26507","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-3036"},{"url":"https://github.com/advisories/GHSA-gqxc-7qg9-p46c"}],"sources":{"cve":[{"id":"CVE-2006-3036","description":"Multiple cross-site scripting (XSS) vulnerabilities in 35mmslidegallery 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) imgdir parameter in (a) index.php, and the (2) w, (3) h, and (4) t parameters in (b) popup.php.","status":"published","published":"2006-06-15T10:00:00Z","modified":"2024-08-07T18:16:06.076Z","updated_at":"2026-11-02T14:33:49.62488Z"}],"euvd":[{"id":"EUVD-2006-3033","description":"Multiple cross-site scripting (XSS) vulnerabilities in 35mmslidegallery 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) imgdir parameter in (a) index.php, and the (2) w, (3) h, and (4) t parameters in (b) popup.php.","status":"published","published":"2006-06-15T10:00:00Z","modified":"2024-08-07T18:16:06Z","updated_at":"2026-11-03T01:15:57.635752Z"}],"ghsa":[{"id":"GHSA-gqxc-7qg9-p46c","title":"Multiple cross-site scripting (XSS) vulnerabilities in 35mmslidegallery 6.0 allow remote...","description":"Multiple cross-site scripting (XSS) vulnerabilities in 35mmslidegallery 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) imgdir parameter in (a) index.php, and the (2) w, (3) h, and (4) t parameters in (b) popup.php.","status":"published","published":"2022-05-01T07:05:02Z","modified":"2023-01-31T05:01:29Z","updated_at":"2026-11-02T14:48:04.351357Z"}],"nvd":[{"id":"CVE-2006-3036","description":"Multiple cross-site scripting (XSS) vulnerabilities in 35mmslidegallery 6.0 allow remote attackers to inject arbitrary web script or HTML via the (1) imgdir parameter in (a) index.php, and the (2) w, (3) h, and (4) t parameters in (b) popup.php.","status":"published","published":"2006-06-15T10:02:00Z","modified":"2026-06-16T22:26:16.403Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:01:03.750605Z"}]}}