$ cve CVE-2005-4226 JSON

CVE-2005-4226 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 3.2% (pctl 88)

Patch early

A public exploit exists.

Description

Multiple "potential" SQL injection vulnerabilities in phpWebThings 1.4 Patched might allow remote attackers to execute arbitrary SQL commands via (1) the ref parameter in download.php, (2) the direction, msg, sforum, reason, subname, and toform parameters in forum.php, (3) the msg and forum parameters in forum_edit.php, (4) the msg and forum parameters in forum_write.php, (5) the tekst parameter in guestbook.php, (6) the menuoption parameter in index.php, and the (7) sel_avatar parameter in myaccount.php. NOTE: the forum.php/forum vector is already identified by CVE-2005-3585.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	3.22% — more likely to be exploited than 88% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2005-12-14
Last modified	2026-06-16

Affected (1)

Vendor	Product
phpwebthings	phpwebthings

Public exploits

Source	Title	Date
exploit-db	PHPWebThings 1.4 - 'msg'/'forum' SQL Injection	2005-11-16
exploit-db	PHPWebThings 1.4 - 'forum' SQL Injection	2005-11-16

References

→ the Explorer · watch your stack · NVD