{"api_version":"1","generated_at":"2026-07-23T09:50:01+00:00","cve":"CVE-2006-0638","urls":{"html":"https://cve.report/CVE-2006-0638","api":"https://cve.report/api/cve/CVE-2006-0638.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-0638","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-0638"},"summary":{"title":"CVE-2006-0638","description":"SQL injection vulnerability in moderation.php in MyBB (aka MyBulletinBoard) 1.0.3 allows remote authenticated users, with certain privileges for moderating and merging posts, to execute arbitrary SQL commands via the posts parameter.","state":"PUBLISHED","assigner":"mitre","published_at":"2006-02-10 11:02:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://secunia.com/advisories/18754","name":"http://secunia.com/advisories/18754","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"MyBB \"posts\" SQL Injection Vulnerability - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/424335/100/0/threaded","name":"http://www.securityfocus.com/archive/1/424335/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2006/0475","name":"http://www.vupen.com/english/advisories/2006/0475","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/22957","name":"http://www.osvdb.org/22957","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://myimei.com/security/2006-02-07/mybb103moderationphpsqlinject-while-merging-posts.html","name":"http://myimei.com/security/2006-02-07/mybb103moderationphpsqlinject-while-merging-posts.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"imei Addmimistrator’s BugBlog  » Blog Archive   » MyBB1.0.3~moderation.php~SqlInject while merging posts","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/16538","name":"http://www.securityfocus.com/bid/16538","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"MyBB Moderation.PHP SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-0638","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-0638","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"638","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mybulletinboard","cpe5":"mybulletinboard","cpe6":"1.0.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2006","cve_id":"638","cve":"CVE-2006-0638","epss":"0.008200000","percentile":"0.744280000","score_date":"2026-04-16","updated_at":"2026-04-17 00:09:25"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T16:41:29.139Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"16538","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/16538"},{"name":"22957","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/22957"},{"name":"ADV-2006-0475","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2006/0475"},{"name":"18754","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/18754"},{"name":"20060207 [myimei]MyBB1.0.3~moderation.php~SqlInject while merging posts","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/424335/100/0/threaded"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://myimei.com/security/2006-02-07/mybb103moderationphpsqlinject-while-merging-posts.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-02-07T00:00:00.000Z","descriptions":[{"lang":"en","value":"SQL injection vulnerability in moderation.php in MyBB (aka MyBulletinBoard) 1.0.3 allows remote authenticated users, with certain privileges for moderating and merging posts, to execute arbitrary SQL commands via the posts parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-19T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"16538","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/16538"},{"name":"22957","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/22957"},{"name":"ADV-2006-0475","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2006/0475"},{"name":"18754","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/18754"},{"name":"20060207 [myimei]MyBB1.0.3~moderation.php~SqlInject while merging posts","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/424335/100/0/threaded"},{"tags":["x_refsource_MISC"],"url":"http://myimei.com/security/2006-02-07/mybb103moderationphpsqlinject-while-merging-posts.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-0638","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SQL injection vulnerability in moderation.php in MyBB (aka MyBulletinBoard) 1.0.3 allows remote authenticated users, with certain privileges for moderating and merging posts, to execute arbitrary SQL commands via the posts parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"16538","refsource":"BID","url":"http://www.securityfocus.com/bid/16538"},{"name":"22957","refsource":"OSVDB","url":"http://www.osvdb.org/22957"},{"name":"ADV-2006-0475","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/0475"},{"name":"18754","refsource":"SECUNIA","url":"http://secunia.com/advisories/18754"},{"name":"20060207 [myimei]MyBB1.0.3~moderation.php~SqlInject while merging posts","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/424335/100/0/threaded"},{"name":"http://myimei.com/security/2006-02-07/mybb103moderationphpsqlinject-while-merging-posts.html","refsource":"MISC","url":"http://myimei.com/security/2006-02-07/mybb103moderationphpsqlinject-while-merging-posts.html"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-0638","datePublished":"2006-02-10T11:00:00.000Z","dateReserved":"2006-02-10T00:00:00.000Z","dateUpdated":"2024-08-07T16:41:29.139Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-02-10 11:02:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mybulletinboard:mybulletinboard:1.0.3:*:*:*:*:*:*:*","matchCriteriaId":"98789943-2C7D-404E-B61E-04C436C1681C"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"638","Ordinal":"1","Title":"CVE-2006-0638","CVE":"CVE-2006-0638","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"638","Ordinal":"1","NoteData":"SQL injection vulnerability in moderation.php in MyBB (aka MyBulletinBoard) 1.0.3 allows remote authenticated users, with certain privileges for moderating and merging posts, to execute arbitrary SQL commands via the posts parameter.","Type":"Description","Title":"CVE-2006-0638"},{"CveYear":"2006","CveId":"638","Ordinal":"2","NoteData":"2006-02-10","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"638","Ordinal":"3","NoteData":"2018-10-19","Type":"Other","Title":"Modified"}]}}}