CVE-2006-3014

Microsoft Excel allows user-assisted attackers to execute arbitrary javascript and redirect users to arbitrary sites via an Excel spreadsheet with an embedded Shockwave Flash Player ActiveX Object, which is automatically executed when the user opens the spreadsheet.

• CWE-20

• http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0414.htmlExploit
• http://hackingspirits.com/vuln-rnd/vuln-rnd.htmlExploit
• http://secunia.com/advisories/21865Patch, Vendor Advisory
• http://secunia.com/advisories/22882Vendor Advisory
• http://securitytracker.com/id?1016344
• http://www.adobe.com/support/security/bulletins/apsb06-11.html
• http://www.securiteam.com/windowsntfocus/5TP0M0KIUA.html
• http://www.securityfocus.com/bid/18583Exploit
• http://www.securityfocus.com/bid/19980Patch
• http://www.us-cert.gov/cas/techalerts/TA06-318A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2006/3573Vendor Advisory
• http://www.vupen.com/english/advisories/2006/3577Vendor Advisory
• http://www.vupen.com/english/advisories/2006/4507Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27312
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A538
• http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0414.htmlExploit
• http://hackingspirits.com/vuln-rnd/vuln-rnd.htmlExploit
• http://secunia.com/advisories/21865Patch, Vendor Advisory
• http://secunia.com/advisories/22882Vendor Advisory
• http://securitytracker.com/id?1016344
• http://www.adobe.com/support/security/bulletins/apsb06-11.html
• http://www.securiteam.com/windowsntfocus/5TP0M0KIUA.html
• http://www.securityfocus.com/bid/18583Exploit
• http://www.securityfocus.com/bid/19980Patch
• http://www.us-cert.gov/cas/techalerts/TA06-318A.htmlUS Government Resource
• http://www.vupen.com/english/advisories/2006/3573Vendor Advisory
• http://www.vupen.com/english/advisories/2006/3577Vendor Advisory
• http://www.vupen.com/english/advisories/2006/4507Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-069
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27312
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A538

Published

Jun 22, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-3008Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2006-3009Multiple cross-site scripting (XSS) vulnerabilities in Open …
• CVE-2006-3010Multiple SQL injection vulnerabilities in Open Business Mana…
• CVE-2006-3011The error_log function in basic_functions.c in PHP before 4.…
• CVE-2006-3012SQL injection vulnerability in phpBannerExchange before 2.0 …
• CVE-2006-3013Interpretation conflict in resetpw.php in phpBannerExchange …
• CVE-2006-3015Argument injection vulnerability in WinSCP 3.8.1 build 328 a…
• CVE-2006-3016Unspecified vulnerability in session.c in PHP before 5.1.3 h…
• CVE-2006-3017zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.…
• CVE-2006-3018Unspecified vulnerability in the session extension functiona…
• CVE-2006-3019Multiple PHP remote file inclusion vulnerabilities in phpCMS…
• CVE-2006-3020Multiple cross-site scripting (XSS) vulnerabilities in FullP…