CVE catalog

CVE-2006-3848

ipcalc: CVE-2006-3848

Severity: Medium
Published: Jul 25, 2006, 11:04:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.70% · Oct 25, 2026

Cross-site scripting (XSS) vulnerability in CGI wrapper for IP Calculator (IPCalc) 0.40 allows remote attackers to inject arbitrary web script or HTML via the URI (REQUEST_URI environment variable), which is used in the actionurl variable.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	ipcalc	sid	`0.51-1`	fixed
Debian	ipcalc	forky	`0.51-1`	fixed
Debian	ipcalc	trixie	`0.51-1`	fixed
Debian	ipcalc	bookworm	`0.42-2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	ipcalc	source	sid	`0.41-1`	low	Not reported	[381469]
Debian	ipcalc	source	forky	`0.41-1`	low	Not reported	[381469]
Debian	ipcalc	source	trixie	`0.41-1`	low	Not reported	[381469]
Debian	ipcalc	source	bookworm	`0.41-1`	low	Not reported	[381469]

[Debian bug #381469]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[ipcalc]Fixed
Details (2)
- 0.42-2 · all · bookworm
  Fixed · Fixed: 0.41-1
  dsa · ipcalc · debian · bookworm; dsa · ipcalc · debian · 12
- 0.42-2 · all · bookworm
  Fixed · Fixed: 0.41-1
  dsa · ipcalc · debian · bookworm; dsa · ipcalc · debian · 12

[Debian 13 (Trixie)]

[ipcalc]Fixed
Details (2)
- 0.51-1 · all · trixie
  Fixed · Fixed: 0.41-1
  dsa · ipcalc · debian · 13
- 0.51-1 · all · trixie
  Fixed · Fixed: 0.41-1
  dsa · ipcalc · debian · 13

Observed: Oct 23, 2026, 5:03:09 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]