Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2006-0032

CWE-79 — Cross-site Scripting (XSS)4 documents4 sources
Severity
4.3MEDIUM
EPSS
74.4%
top 1.16%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Microsoft Windows 2000Microsoft Windows 2003 Server
Timeline
PublishedSep 12
Latest updateMay 1

Description

Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Auto Select, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded URL, which is injected into an error message whose charset is set to UTF-7.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages2 packages

▶NVDmicrosoft/windows_2000resource_kit

Patches

Patch: secunia.com ↗Patch: www.securityfocus.com ↗Patch: secunia.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-j37x-hh95-r628: Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Au↗2022-05-01
▶
CVEList
CVE-2006-0032: Cross-site scripting (XSS) vulnerability in the Indexing Service in Microsoft Windows 2000, XP, and Server 2003, when the Encoding option is set to Au↗2006-09-12
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Indexing Service - Query Validation Cross-Site Scripting↗2006-09-12
▶