{"api_version":"1","generated_at":"2026-07-23T09:00:35+00:00","cve":"CVE-2006-3926","urls":{"html":"https://cve.report/CVE-2006-3926","api":"https://cve.report/api/cve/CVE-2006-3926.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-3926","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-3926"},"summary":{"title":"CVE-2006-3926","description":"Multiple SQL injection vulnerabilities in PhpProBid 5.24 allow remote attackers to execute arbitrary SQL commands via the (1) view or (2) start parameters to (a) viewfeedback.php or the (3) orderType parameter to (b) categories.php.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2006-07-31 21:04:00","updated_at":"2017-07-20 01:32:00"},"problem_types":["NVD-CWE-Other"],"metrics":[],"references":[{"url":"http://www.securityfocus.com/bid/19158","name":"19158","refsource":"BID","tags":["Exploit"],"title":"PHP Pro Bid Multiple Input Validation Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.osvdb.org/27546","name":"27546","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://securitytracker.com/id?1016595","name":"1016595","refsource":"SECTRACK","tags":["Exploit"],"title":"SecurityTracker.com Archives - PHP Pro Bid Input Validation Hole Permits Cross-Site Scripting Attacks and Input Validation Flaw Lets Remote Users Inject SQL Commands","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/1298","name":"1298","refsource":"SREASON","tags":[],"title":"SecurityReason - Phpprobid <= 5.24 XSS SQL injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/27545","name":"27545","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/21201","name":"21201","refsource":"SECUNIA","tags":["Vendor Advisory"],"title":"PHP Pro Bid Cross-Site Scripting and SQL Injection - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28032","name":"phpprobid-categories-sql-injection(28032)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://archives.neohapsis.com/archives/bugtraq/2006-07/0474.html","name":"20060725 Phpprobid <= 5.24 XSS SQL injection Vulnerability","refsource":"BUGTRAQ","tags":["Exploit"],"title":"Neohapsis Archives - Bugtraq - #0474 - Phpprobid <= 5.24 XSS SQL injection Vulnerability","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-3926","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-3926","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"3926","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"php_pro_bid","cpe5":"php_pro_bid","cpe6":"5.24","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"3926","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"php_pro_bid","cpe5":"php_pro_bid","cpe6":"5.24","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-3926","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in PhpProBid 5.24 allow remote attackers to execute arbitrary SQL commands via the (1) view or (2) start parameters to (a) viewfeedback.php or the (3) orderType parameter to (b) categories.php."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"phpprobid-categories-sql-injection(28032)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/28032"},{"name":"1016595","refsource":"SECTRACK","url":"http://securitytracker.com/id?1016595"},{"name":"27546","refsource":"OSVDB","url":"http://www.osvdb.org/27546"},{"name":"27545","refsource":"OSVDB","url":"http://www.osvdb.org/27545"},{"name":"21201","refsource":"SECUNIA","url":"http://secunia.com/advisories/21201"},{"name":"19158","refsource":"BID","url":"http://www.securityfocus.com/bid/19158"},{"name":"20060725 Phpprobid <= 5.24 XSS SQL injection Vulnerability","refsource":"BUGTRAQ","url":"http://archives.neohapsis.com/archives/bugtraq/2006-07/0474.html"},{"name":"1298","refsource":"SREASON","url":"http://securityreason.com/securityalert/1298"}]}},"nvd":{"publishedDate":"2006-07-31 21:04:00","lastModifiedDate":"2017-07-20 01:32:00","problem_types":["NVD-CWE-Other"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:php_pro_bid:php_pro_bid:5.24:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"3926","Ordinal":"19252","Title":"CVE-2006-3926","CVE":"CVE-2006-3926","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"3926","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in PhpProBid 5.24 allow remote attackers to execute arbitrary SQL commands via the (1) view or (2) start parameters to (a) viewfeedback.php or the (3) orderType parameter to (b) categories.php.","Type":"Description","Title":null},{"CveYear":"2006","CveId":"3926","Ordinal":"2","NoteData":"2006-07-31","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"3926","Ordinal":"3","NoteData":"2017-07-19","Type":"Other","Title":"Modified"}]}}}