← Vulnerability feed

Vulnerability record · CVE-2006-2394 · published 16 May 2006

CVE-2006-2394: Turnkey web tools php live helper vulnerability

Turnkey Web Tools · Php Live Helper

Cross-site scripting (XSS) vulnerability in chat.php in PHP Live Helper allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter.

5.8 CVSS 2.0 Medium EPSS 1.3% · top 31.1%
5.8CVSS 2.0 base score
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

Cross-site scripting (XSS) vulnerability in chat.php in PHP Live Helper allows remote attackers to inject arbitrary web script or HTML via the PHPSESSID parameter.

AV:N/AC:M/Au:N/C:P/I:P/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://securityreason.com/securityalert/895
http://www.securityfocus.com/archive/1/433888/100/0/threaded
http://www.securityfocus.com/bid/17960 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/26497
http://securityreason.com/securityalert/895
http://www.securityfocus.com/archive/1/433888/100/0/threaded
http://www.securityfocus.com/bid/17960 Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/26497

Track CVE-2006-2394 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2006-4051Turnkey web tools php live helper vulnerabilityPHP remote file inclusion vulnerability in global.php in Turnkey Web Tools PHP Live Helper 2.0 and earlier allows remote attackers to execute arbitra…EPSS 8.3%7.5CVE-2006-1477Turnkey web tools php live helper vulnerabilityMultiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Live Helper 1.8 allow remote attackers to include and execute arbitrary P…EPSS 4.8%7.5CVE-2006-1478Turnkey web tools php live helper vulnerabilityDirectory traversal vulnerability in (1) initiate.php and (2) possibly other PHP scripts in Turnkey Web Tools PHP Live Helper 1.8, and possibly later…EPSS 2.0%

Source: NIST National Vulnerability Database (record CVE-2006-2394), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.