{"api_version":"1","generated_at":"2026-07-23T07:48:32+00:00","cve":"CVE-2006-5908","urls":{"html":"https://cve.report/CVE-2006-5908","api":"https://cve.report/api/cve/CVE-2006-5908.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-5908","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-5908"},"summary":{"title":"CVE-2006-5908","description":"Multiple SQL injection vulnerabilities in the login_user function in yans.func.php in Lucas Rodriguez San Pedro Yet Another News System (YANS) 0.2b allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.","state":"PUBLISHED","assigner":"mitre","published_at":"2006-11-15 15:07:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30119","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30119","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/20963","name":"http://www.securityfocus.com/bid/20963","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"YANS Yans.News.PHP SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://archives.neohapsis.com/archives/bugtraq/2006-11/0121.html","name":"http://archives.neohapsis.com/archives/bugtraq/2006-11/0121.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"NEOHAPSIS - Peace of Mind Through Integrity and Insight","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://securityreason.com/securityalert/1866","name":"http://securityreason.com/securityalert/1866","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CXSecurity - IDS","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-5908","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-5908","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"5908","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"lucas_rodriguez_san_pedro","cpe5":"yet_another_news_system","cpe6":"0.2b","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T20:12:30.566Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"yans-username-sql-injection(30119)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30119"},{"name":"1866","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/1866"},{"name":"20061108 Y.A.N.S sql injection","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://archives.neohapsis.com/archives/bugtraq/2006-11/0121.html"},{"name":"20963","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/20963"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2006-11-08T00:00:00.000Z","descriptions":[{"lang":"en","value":"Multiple SQL injection vulnerabilities in the login_user function in yans.func.php in Lucas Rodriguez San Pedro Yet Another News System (YANS) 0.2b allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-19T15:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"yans-username-sql-injection(30119)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30119"},{"name":"1866","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/1866"},{"name":"20061108 Y.A.N.S sql injection","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://archives.neohapsis.com/archives/bugtraq/2006-11/0121.html"},{"name":"20963","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/20963"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-5908","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple SQL injection vulnerabilities in the login_user function in yans.func.php in Lucas Rodriguez San Pedro Yet Another News System (YANS) 0.2b allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"yans-username-sql-injection(30119)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30119"},{"name":"1866","refsource":"SREASON","url":"http://securityreason.com/securityalert/1866"},{"name":"20061108 Y.A.N.S sql injection","refsource":"BUGTRAQ","url":"http://archives.neohapsis.com/archives/bugtraq/2006-11/0121.html"},{"name":"20963","refsource":"BID","url":"http://www.securityfocus.com/bid/20963"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2006-5908","datePublished":"2006-11-15T15:00:00.000Z","dateReserved":"2006-11-15T00:00:00.000Z","dateUpdated":"2024-08-07T20:12:30.566Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2006-11-15 15:07:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lucas_rodriguez_san_pedro:yet_another_news_system:0.2b:*:*:*:*:*:*:*","matchCriteriaId":"E3E37747-9A1C-4944-B6AE-8AF73CE912F1"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"5908","Ordinal":"1","Title":"CVE-2006-5908","CVE":"CVE-2006-5908","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"5908","Ordinal":"1","NoteData":"Multiple SQL injection vulnerabilities in the login_user function in yans.func.php in Lucas Rodriguez San Pedro Yet Another News System (YANS) 0.2b allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.","Type":"Description","Title":"CVE-2006-5908"},{"CveYear":"2006","CveId":"5908","Ordinal":"2","NoteData":"2006-11-15","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"5908","Ordinal":"3","NoteData":"2017-07-19","Type":"Other","Title":"Modified"}]}}}