CVE-2006-2351
IPswitch WhatsUp Professional 2006 - Cross-Site Scripting via sDeviceView, nDeviceID, or sHostname Parameter
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2006-2351. PoCs published by David Maciejak.
AI-analyzed exploit summary The provided text describes multiple input-validation vulnerabilities in WhatsUp Professional, including remote file inclusion, XSS, and information disclosure. However, no actual exploit code is present—only a description and a sample URL.
Description
Multiple cross-site scripting (XSS) vulnerabilities in IPswitch WhatsUp Professional 2006 and WhatsUp Professional 2006 Premium allow remote attackers to inject arbitrary web script or HTML via the (1) sDeviceView or (2) nDeviceID parameter to (a) NmConsole/Navigation.asp or (3) sHostname parameter to (b) NmConsole/ToolResults.asp.
Exploits (2)
The provided text describes multiple input-validation vulnerabilities in WhatsUp Professional, including remote file inclusion, XSS, and information disclosure. However, no actual exploit code is present—only a description and a sample URL.
The provided text is a vulnerability description for CVE-2006-2351, detailing multiple input-validation issues in WhatsUp Professional, including remote file inclusion, XSS, and information disclosure. It lacks actual exploit code or a proof-of-concept, serving only as a high-level summary.