CVE-2006-2140

medium

Description

Multiple cross-site scripting (XSS) vulnerabilities in OrbitHYIP 2.0 and earlier allow remote attackers to inject arbitrary web script via the (1) referral parameter to signup.php or (2) id parameter to members.php.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/26163

http://www.vupen.com/english/advisories/2006/1583

http://www.securityfocus.com/bid/17766

http://www.osvdb.org/25142

http://www.osvdb.org/25141

http://secunia.com/advisories/19877

http://pridels0.blogspot.com/2006/04/orbithyip-xss.html

Details

Source: Mitre, NVD

Published: 2006-05-02

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 5.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N