VULNERABILITY INTELLIGENCE

CVE-2006-4782

CVSS score5.4 MEDIUM
EPSS probability3.24%
CISA KEVNot currently listed
Published2006-09-14
Last modified2026-06-16
CVSS vectorAV:N/AC:H/Au:N/C:C/I:N/A:N

Description

src/index.php in WebSPELL 4.01.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication and gain sensitive information stored in the database via a modified userID parameter in a write action to admin/database.php.

Primary references