{"enchantments": {"score": {"value": 5.6, "vector": "NONE", "modified": "2017-04-28T13:20:26", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2006-5564"]}, {"type": "exploitdb", "idList": ["EDB-ID:28863"]}], "modified": "2017-04-28T13:20:26", "rev": 2}, "vulnersScore": 5.6}, "bulletinFamily": "software", "affectedSoftware": [], "references": [], "href": "https://vulners.com/osvdb/OSVDB:30040", "id": "OSVDB:30040", "title": "MAXdev MD-Pro user.php op Variable XSS", "type": "osvdb", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "lastseen": "2017-04-28T13:20:26", "edition": 1, "reporter": "OSVDB", "description": "## Manual Testing Notes\nhttp://[target]/user.php?uname=1&module=NS- LostPassword&op=[code]\n## References:\nVendor Specific News/Changelog Entry: http://www.maxdev.com/Article608.phtml\n[Secunia Advisory ID:22564](https://secuniaresearch.flexerasoftware.com/advisories/22564/)\n[Related OSVDB ID: 30041](https://vulners.com/osvdb/OSVDB:30041)\nFrSIRT Advisory: ADV-2006-4195\n[CVE-2006-5564](https://vulners.com/cve/CVE-2006-5564)\nBugtraq ID: 20752\n", "modified": "2006-10-25T10:03:48", "viewCount": 26, "published": "2006-10-25T10:03:48", "cvelist": ["CVE-2006-5564"], "immutableFields": []}

{"cve": [{"lastseen": "2021-02-02T05:27:25", "description": "Cross-site scripting (XSS) vulnerability in user.php in MAXdev MD-Pro 1.0.76 allows remote attackers to inject arbitrary web script or HTML via the op parameter. NOTE: the provenance of this information is unknown; the details are obtained from third party information.", "edition": 6, "cvss3": {}, "published": "2006-10-27T16:07:00", "title": "CVE-2006-5564", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2006-5564"], "modified": "2011-03-08T02:43:00", "cpe": ["cpe:/a:maxdev:md-pro:1.0.76"], "id": "CVE-2006-5564", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-5564", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:maxdev:md-pro:1.0.76:*:*:*:*:*:*:*"]}], "exploitdb": [{"lastseen": "2016-02-03T09:05:56", "description": "MAXdev MD-Pro 1.0.76 User.PHP Cross-Site Scripting Vulnerability. CVE-2006-5564. Webapps exploit for php platform", "published": "2006-10-26T00:00:00", "type": "exploitdb", "title": "MAXdev MD-Pro 1.0.76 User.PHP Cross-Site Scripting Vulnerability", "bulletinFamily": "exploit", "cvelist": ["CVE-2006-5564"], "modified": "2006-10-26T00:00:00", "id": "EDB-ID:28863", "href": "https://www.exploit-db.com/exploits/28863/", "sourceData": "source: http://www.securityfocus.com/bid/20752/info\r\n\r\nMAXdev MD-Pro is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. \r\n\r\nAn attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.\r\n\r\nMaxdev MD-Pro 1.0.76 is vulnerable; earlier versions may also be affected.\r\n\r\nhttp://www.example.com/user.php?uname=1&module=NS-LostPassword&op=[code]", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "sourceHref": "https://www.exploit-db.com/download/28863/"}]}