{"api_version":"1","generated_at":"2026-07-24T20:53:20+00:00","cve":"CVE-2006-1426","urls":{"html":"https://cve.report/CVE-2006-1426","api":"https://cve.report/api/cve/CVE-2006-1426.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-1426","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-1426"},"summary":{"title":"CVE-2006-1426","description":"Multiple SQL injection vulnerabilities in Pixel Motion Blog allow remote attackers to execute arbitrary SQL commands via the (1) date parameter in index.php or bypass authentication via the (2) password parameter in admin/index.php.","state":"PUBLISHED","assigner":"mitre","published_at":"2006-03-28 20:02:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://www.vupen.com/english/advisories/2006/1135","name":"http://www.vupen.com/english/advisories/2006/1135","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/17260","name":"http://www.securityfocus.com/bid/17260","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Pixel Motion Multiple SQL Injection Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25478","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25478","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/19421","name":"http://secunia.com/advisories/19421","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"Pixel Motion Blog SQL Injection Vulnerabilities - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/24168","name":"http://www.osvdb.org/24168","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25481","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25481","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/24169","name":"http://www.osvdb.org/24169","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/archive/1/428964/100/0/threaded","name":"http://www.securityfocus.com/archive/1/428964/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-1426","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-1426","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"1426","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"pixel_motion","cpe5":"pixel_motion_blog","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2006","cve_id":"1426","cve":"CVE-2006-1426","epss":"0.020750000","percentile":"0.839850000","score_date":"2026-04-19","updated_at":"2026-04-20 00:11:20"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T17:12:21.776Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20060327 Blog Pixel Motion<=1.xx Authentication Bypass Vulnerability & SQL injection","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/428964/100/0/threaded"},{"name":"pixelmotionblog-adminindex-security-bypass(25478)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25478"},{"name":"24169","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/24169"},{"name":"17260","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/17260"},{"name":"pixelmotionblog-index-sql-injection(25481)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25481"},{"name":"19421","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/19421"},{"name":"ADV-2006-1135","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2006/1135"},{"name":"24168","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/24168"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-03-27T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in Pixel Motion Blog allow remote attackers to execute arbitrary SQL commands via the (1) date parameter in index.php or bypass authentication via the (2) password parameter in admin/index.php."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-18T14:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20060327 Blog Pixel Motion<=1.xx Authentication Bypass Vulnerability & SQL injection","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/428964/100/0/threaded"},{"name":"pixelmotionblog-adminindex-security-bypass(25478)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25478"},{"name":"24169","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/24169"},{"name":"17260","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/17260"},{"name":"pixelmotionblog-index-sql-injection(25481)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25481"},{"name":"19421","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/19421"},{"name":"ADV-2006-1135","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2006/1135"},{"name":"24168","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/24168"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-1426","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in Pixel Motion Blog allow remote attackers to execute arbitrary SQL commands via the (1) date parameter in index.php or bypass authentication via the (2) password parameter in admin/index.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20060327 Blog Pixel Motion<=1.xx Authentication Bypass Vulnerability & SQL injection","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/428964/100/0/threaded"},{"name":"pixelmotionblog-adminindex-security-bypass(25478)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25478"},{"name":"24169","refsource":"OSVDB","url":"http://www.osvdb.org/24169"},{"name":"17260","refsource":"BID","url":"http://www.securityfocus.com/bid/17260"},{"name":"pixelmotionblog-index-sql-injection(25481)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/25481"},{"name":"19421","refsource":"SECUNIA","url":"http://secunia.com/advisories/19421"},{"name":"ADV-2006-1135","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/1135"},{"name":"24168","refsource":"OSVDB","url":"http://www.osvdb.org/24168"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-1426","datePublished":"2006-03-28T20:00:00.000Z","dateReserved":"2006-03-28T00:00:00.000Z","dateUpdated":"2024-08-07T17:12:21.776Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-03-28 20:02:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:pixel_motion:pixel_motion_blog:*:*:*:*:*:*:*:*","matchCriteriaId":"10852BB8-8028-49C5-A40C-112190649BB1"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"1426","Ordinal":"1","Title":"CVE-2006-1426","CVE":"CVE-2006-1426","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"1426","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in Pixel Motion Blog allow remote attackers to execute arbitrary SQL commands via the (1) date parameter in index.php or bypass authentication via the (2) password parameter in admin/index.php.","Type":"Description","Title":"CVE-2006-1426"},{"CveYear":"2006","CveId":"1426","Ordinal":"2","NoteData":"2006-03-28","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"1426","Ordinal":"3","NoteData":"2018-10-18","Type":"Other","Title":"Modified"}]}}}