Helm · Helm Web Hosting Control Panel · CVE-2006-1407
**Name of the Vulnerable Software and Affected Versions**
Helm Web Hosting Control Panel versions 3.2.10 and earlier
**Description**
The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the `txtDomainName` parameter to "domains.asp", or the `SearchText` or `UserLevel` parameters to "default.asp".
**Recommendations**
For Helm Web Hosting Control Panel versions 3.2.10 and earlier, update to a version later than 3.2.10 to resolve the issue.
As a temporary workaround, consider restricting access to the "domains.asp" and "default.asp" pages until a patch is available.
Avoid using the `txtDomainName`, `SearchText`, and `UserLevel` parameters in the affected API endpoints until the issue is resolved.