CVE-2006-2418

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerabilities in certain versions of phpMyAdmin before 2.8.0.4 allow remote attackers to inject arbitrary web script or HTML via the db parameter in unknown scripts.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.htmlPatch
http://secunia.com/advisories/20113Patch, Vendor Advisory
http://secunia.com/advisories/20627Patch, Vendor Advisory
http://secunia.com/advisories/22781Patch, Vendor Advisory
http://www.debian.org/security/2006/dsa-1207Patch, Vendor Advisory
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2Patch, Vendor Advisory
http://www.securityfocus.com/bid/17973Patch
http://www.vupen.com/english/advisories/2006/1794
https://exchange.xforce.ibmcloud.com/vulnerabilities/26441
http://lists.suse.com/archive/suse-security-announce/2006-Jun/0003.htmlPatch
http://secunia.com/advisories/20113Patch, Vendor Advisory
http://secunia.com/advisories/20627Patch, Vendor Advisory
http://secunia.com/advisories/22781Patch, Vendor Advisory
http://www.debian.org/security/2006/dsa-1207Patch, Vendor Advisory
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-2Patch, Vendor Advisory
http://www.securityfocus.com/bid/17973Patch
http://www.vupen.com/english/advisories/2006/1794
https://exchange.xforce.ibmcloud.com/vulnerabilities/26441

Timeline

Published: May 16, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-24194.3Cross-site scripting (XSS) vulnerability in index.php in Directory Listing Script allows remote attackers to inject arbitrary web script or CVE-2006-24204.3Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting (XSS) attacks via a ti CVE-2006-24217.5Stack-based buffer overflow in Pragma FortressSSH 4.0.7.20 allows remote attackers to execute arbitrary code via long SSH_MSG_KEXINIT messag CVE-2006-24225.0phpCOIN 1.2.3 and earlier stores messages based upon e-mail addresses, which allows remote authenticated users to read messages for other us CVE-2006-24234.3Cross-site scripting (XSS) vulnerability in ftplogin/index.php in Confixx 3.1.2 allows remote attackers to inject arbitrary web script or HT CVE-2006-24245.1PHP remote file inclusion vulnerability in ezUserManager 1.6 and earlier, when register_globals is enabled, allows remote attackers to execu CVE-2006-24254.3Multiple cross-site scripting (XSS) vulnerabilities in PRV.php in PhpRemoteView, possibly 2003-10-23 and earlier, allow remote attackers to CVE-2006-24266.4Sun Java Runtime Environment (JRE) 1.5.0_6 and earlier, JDK 1.5.0_6 and earlier, and SDK 1.5.0_6 and earlier allows remote attackers to caus CVE-2006-24277.2freshclam in (1) Clam Antivirus (ClamAV) 0.88 and (2) ClamXav 1.0.3h and earlier does not drop privileges before processing the config-file CVE-2006-24287.5add.asp in DUware DUbanner 3.1 allows remote attackers to execute arbitrary code by uploading files with arbitrary extensions, such as ASP f CVE-2006-242910.0Unspecified vulnerability in IBM WebSphere Application Server 6.0.2, 6.0.2.1, 6.0.2.3, 6.0.2.5, and 6.0.2.7 has unknown impact and remote at CVE-2006-243010.0IBM WebSphere Application Server 5.0.2 and earlier, 5.1.1 and earlier, and 6.0.2 up to 6.0.2.7 records user credentials in plaintext in addN