{"id":"CVE-2006-4293","aliases":["EUVD-2006-4281","GHSA-hwf6-x4hq-wmc3"],"status":"published","title":"Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject...","description":"Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter in dohtaccess.html, or the (2) file parameter in (a) editit.html or (b) showfile.html.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02359,"percentile":0.83873,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2006-08-22T17:00:00Z","modified":"2026-06-16T22:28:47Z","exploits":[{"source":"exploitdb","id":"EDB-28413","title":"cPanel 10.x - 'dohtaccess.html?dir' Cross-Site Scripting","type":"webapps","platform":"php","date":"2006-08-21","verified":true,"url":"https://www.exploit-db.com/exploits/28413"},{"source":"exploitdb","id":"EDB-28414","title":"cPanel 10.x - 'editit.html?File' Cross-Site Scripting","type":"webapps","platform":"php","date":"2006-08-21","verified":true,"url":"https://www.exploit-db.com/exploits/28414"},{"source":"exploitdb","id":"EDB-28415","title":"cPanel 10.x - 'showfile.html?File' Cross-Site Scripting","type":"webapps","platform":"php","date":"2006-08-21","verified":true,"url":"https://www.exploit-db.com/exploits/28415"}],"products":[{"vendor":"cpanel","product":"cpanel"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28447","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"http://www.osvdb.org/28043","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.securityfocus.com/bid/19624","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://secunia.com/advisories/21592","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Exploit","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/443637/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://www.osvdb.org/28041","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://securityreason.com/securityalert/1442","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"]},{"url":"http://www.osvdb.org/28042","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-4293"},{"url":"https://github.com/advisories/GHSA-hwf6-x4hq-wmc3"}],"sources":{"cve":[{"id":"CVE-2006-4293","description":"Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter in dohtaccess.html, or the (2) file parameter in (a) editit.html or (b) showfile.html.","status":"published","published":"2006-08-22T17:00:00Z","modified":"2024-08-07T19:06:06.506Z","updated_at":"2026-11-02T14:33:51.085765Z"}],"euvd":[{"id":"EUVD-2006-4281","description":"Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter in dohtaccess.html, or the (2) file parameter in (a) editit.html or (b) showfile.html.","status":"published","published":"2006-08-22T17:00:00Z","modified":"2024-08-07T19:06:06Z","updated_at":"2026-11-03T01:15:52.657645Z"}],"ghsa":[{"id":"GHSA-hwf6-x4hq-wmc3","title":"Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject...","description":"Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter in dohtaccess.html, or the (2) file parameter in (a) editit.html or (b) showfile.html.","status":"published","published":"2022-05-01T07:17:14Z","modified":"2023-01-31T05:01:47Z","updated_at":"2026-11-02T14:48:08.305035Z"}],"nvd":[{"id":"CVE-2006-4293","description":"Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote attackers to inject arbitrary web script or HTML via the (1) dir parameter in dohtaccess.html, or the (2) file parameter in (a) editit.html or (b) showfile.html.","status":"published","published":"2006-08-22T17:04:00Z","modified":"2026-06-16T22:28:47.973Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:01:05.928789Z"}]}}