First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2006-2660

LowCVSS 2.1/10Last modified Jun 16, 2026

Description

Buffer consumption vulnerability in the tempnam function in PHP 5.1.4 and 4.x before 4.4.3 allows local users to bypass restrictions and create PHP files with fixed names in other directories via a pathname argument longer than MAXPATHLEN, which prevents a unique string from being appended to the filename.

Metrics

CVSS 2.0 2.1/10AV:L/AC:L/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

Timeline

Published: Jun 13, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-26615.0ftutil.c in Freetype before 2.2 allows remote attackers to cause a denial of service (crash) via a crafted font file that triggers a null de CVE-2006-26624.6VMware Server before RC1 does not clear user credentials from memory after a console connection is made, which might allow local attackers t CVE-2006-26634.3Multiple cross-site scripting (XSS) vulnerabilities in iFlance 1.1 allow remote attackers to inject arbitrary web script or HTML via certain CVE-2006-26645.8Cross-site scripting (XSS) vulnerability in iFdate 1.2 allows remote attackers to inject arbitrary web script or HTML via the (1) username, CVE-2006-26657.5PHP remote file inclusion vulnerability in includes/mailaccess/pop3/core.php in V-Webmail 1.3 allows remote attackers to execute arbitrary P CVE-2006-26667.5PHP remote file inclusion vulnerability in includes/mailaccess/pop3.php in V-Webmail 1.5 through 1.6.4 allows remote attackers to execute ar CVE-2006-26677.5Direct static code injection vulnerability in WordPress 2.0.2 and earlier allows remote attackers to execute arbitrary commands by inserting CVE-2006-26687.5Multiple PHP remote file inclusion vulnerabilities in Docebo LMS 2.05 allow remote attackers to execute arbitrary PHP code via a URL in the CVE-2006-26694.3Multiple cross-site scripting (XSS) vulnerabilities in Pre Shopping Mall 1.0 allow remote attackers to inject arbitrary web script or HTML v CVE-2006-26705.8Multiple cross-site scripting (XSS) vulnerabilities in ChatPat 1.0 allow remote attackers to inject arbitrary web script or HTML via a chat CVE-2006-26715.0SQL injection vulnerability in ChatPat 1.0 allows remote attackers to execute arbitrary SQL commands via the nickname field.CVE-2006-26726.8Multiple cross-site scripting (XSS) vulnerabilities in Realty Pro One allow remote attackers to inject arbitrary web script or HTML via the

CVE-2006-2660: Low severity, CVSS 2.1 | Vulnix