CVE-2006-5984
published 2006-11-20CVE-2006-5984: Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 allow remote authenticated users to inject arbitrary web script or…
PriorityP419medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
1.48%
70.7th percentile
Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) txtCompanyName, (2) txtEmail, or (3) txtUserAccNum parameter to (a) users.asp, or the (4) setThemeColour parameter to (b) default.asp in the Reseller and Admin levels; or the (5) setThemeColour parameter to default.asp in the User level. NOTE: the txtDomainName parameter to domains.asp is covered by CVE-2006-1407, which suggests that this vector is fixed in 3.2.10 stable.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| webhost_automation | helm_web_hosting_control_panel | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Webhost Automation Helm Web Hosting Control Panel 3.2.10 users.asp txtDomainName cross site scripting (XFDB-30309 / BID-21096)
vuldb·2026-04-28·CVSS 6.8
CVE-2006-5984 [MEDIUM] Webhost Automation Helm Web Hosting Control Panel 3.2.10 users.asp txtDomainName cross site scripting (XFDB-30309 / BID-21096)
A vulnerability was found in Webhost Automation Helm Web Hosting Control Panel 3.2.10. It has been rated as problematic. Affected by this vulnerability is an unknown functionality of the file users.asp of the component Control Panel. The manipulation of the argument txtDomainName leads to basic cross site scripting.
This vulnerability is documented as CVE-2006-5984. The attack can be initiated remotely. There is not any exploit available.
GHSA
GHSA-78w9-8p3h-w2r9: Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3
ghsa_unreviewed·2022-05-01·CVSS 5.8
CVE-2006-5984 [MEDIUM] GHSA-78w9-8p3h-w2r9: Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3
Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) txtCompanyName, (2) txtEmail, or (3) txtUserAccNum parameter to (a) users.asp, or the (4) setThemeColour parameter to (b) default.asp in the Reseller and Admin levels; or the (5) setThemeColour parameter to default.asp in the User level. NOTE: the txtDomainName parameter to domains.asp is covered by CVE-2006-1407, which suggests that this vector is fixed in 3.2.10 stable.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://aria-security.net/advisory/helm.txthttp://secunia.com/advisories/22916http://securityreason.com/securityalert/1884http://securitytracker.com/id?1017240http://www.securityfocus.com/archive/1/451737/100/0/threadedhttp://www.securityfocus.com/archive/1/451848/100/200/threadedhttp://www.vupen.com/english/advisories/2006/4557https://exchange.xforce.ibmcloud.com/vulnerabilities/30309http://aria-security.net/advisory/helm.txthttp://secunia.com/advisories/22916http://securityreason.com/securityalert/1884http://securitytracker.com/id?1017240http://www.securityfocus.com/archive/1/451737/100/0/threadedhttp://www.securityfocus.com/archive/1/451848/100/200/threadedhttp://www.vupen.com/english/advisories/2006/4557https://exchange.xforce.ibmcloud.com/vulnerabilities/30309
2006-11-20
Published