CVE-2006-2340: Lethal Penguin Passmasterflex

Medium severity, CVSS 5.8. EPSS: 1.3% chance of exploitation in the next 30 days.

Cross-site scripting (XSS) vulnerability in PassMasterFlex and PassMasterFlexPlus (PassMasterFlex+) 1.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) username, (2) password, or (3) User-Agent HTTP header in the Hack Log.

Affected products

• Lethal Penguin Passmasterflex: version 1.2 only
• Lethal Penguin Passmasterflexplus: version 1.2 only

Published 2006-05-12. Last modified 2026-06-16.