Search for vulnerabilities
Vulnerability details: VCID-3jwr-1p7h-6ybs
Vulnerability ID VCID-3jwr-1p7h-6ybs
Aliases CVE-2006-3918
Summary A flaw in the handling of invalid Expect headers. If an attacker can influence the Expect header that a victim sends to a target site they could perform a cross-site scripting attack. It is known that some versions of Flash can set an arbitrary Expect header which can trigger this flaw. Not marked as a security issue for 2.0 or 2.2 as the cross-site scripting is only returned to the victim after the server times out a connection.
Status Published
Exploitability 2.0
Weighted Severity 4.8
Risk 9.6
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
epss 0.80153 https://api.first.org/data/v1/epss?cve=CVE-2006-3918
epss 0.80153 https://api.first.org/data/v1/epss?cve=CVE-2006-3918
epss 0.90108 https://api.first.org/data/v1/epss?cve=CVE-2006-3918
epss 0.90108 https://api.first.org/data/v1/epss?cve=CVE-2006-3918
epss 0.90108 https://api.first.org/data/v1/epss?cve=CVE-2006-3918
epss 0.90108 https://api.first.org/data/v1/epss?cve=CVE-2006-3918
epss 0.90108 https://api.first.org/data/v1/epss?cve=CVE-2006-3918
apache_httpd moderate https://httpd.apache.org/security/json/CVE-2006-3918.json
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2006-3918.json
https://api.first.org/data/v1/epss?cve=CVE-2006-3918
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3918
200732 https://bugzilla.redhat.com/show_bug.cgi?id=200732
381376 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=381376
CVE-2006-3918 https://httpd.apache.org/security/json/CVE-2006-3918.json
CVE-2006-3918;OSVDB-27488 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/remote/28424.txt
CVE-2006-3918;OSVDB-27488 Exploit https://www.securityfocus.com/bid/19661/info
RHSA-2006:0618 https://access.redhat.com/errata/RHSA-2006:0618
RHSA-2006:0619 https://access.redhat.com/errata/RHSA-2006:0619
RHSA-2006:0692 https://access.redhat.com/errata/RHSA-2006:0692
RHSA-2008:0523 https://access.redhat.com/errata/RHSA-2008:0523
USN-575-1 https://usn.ubuntu.com/575-1/
Data source Exploit-DB
Date added Aug. 24, 2006
Description Apache 1.3.35/2.0.58/2.2.2 - Arbitrary HTTP Request Headers Security
Ransomware campaign use Known
Source publication date Aug. 24, 2006
Exploit type remote
Platform linux
Source update date Sept. 21, 2013
Source URL https://www.securityfocus.com/bid/19661/info
Exploit Prediction Scoring System (EPSS)
Percentile 0.99074
EPSS Score 0.80153
Published At Aug. 2, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:28:44.672984+00:00 Apache HTTPD Importer Import https://httpd.apache.org/security/json/CVE-2006-3918.json 37.0.0