Unscored severity · published Nov 14, 2006
CVE-2006-5883
Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) dir parameter in (a)…
–
CVSS
1.7%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) dir parameter in (a) seldir.html, and the (2) user and (3) dir parameters in (b) newuser.html.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Cpanel · Cpanel
10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-5883
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-5883
Exploit
http://aria-security.net/advisory/cpanel.txt
secunia.com
http://secunia.com/advisories/22825
securityreason.com
http://securityreason.com/securityalert/1847
www.osvdb.org
http://www.osvdb.org/30386
www.osvdb.org
http://www.osvdb.org/30387
www.securityfocus.com
http://www.securityfocus.com/archive/1/451374/100/0/threaded
More from Cpanel
9.8
CVE-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
9.8
CVE-2020-26108
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488)
9.8
CVE-2020-26105
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554)
9.8
CVE-2020-26101
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549)
9.8
CVE-2020-26100
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497)