CVE-2006-0135 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 2.3% (pctl 83)
Patch early
A public exploit exists.
Description
SQL injection vulnerability in login.php in TheWebForum (twf) 1.2.1 allows remote attackers to execute arbitrary SQL commands and bypass login authentication via the username parameter (aka the u variable).
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 2.32% — more likely to be exploited than 83% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2006-01-09 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| thewebforum | thewebforum |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | TheWebForum 1.2.1 - Multiple Input Validation Vulnerabilities | 2006-01-06 |
References
- http://evuln.com/vulns/17/exploit.html
- http://evuln.com/vulns/17/summary.html
- http://secunia.com/advisories/18392
- http://securityreason.com/securityalert/321
- http://securitytracker.com/id?1015450
- http://www.osvdb.org/22294
- http://www.securityfocus.com/archive/1/421039/100/0/threaded
- http://www.securityfocus.com/bid/16161
- http://www.vupen.com/english/advisories/2006/0093
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24027
- http://evuln.com/vulns/17/exploit.html
- http://evuln.com/vulns/17/summary.html
- http://secunia.com/advisories/18392
- http://securityreason.com/securityalert/321
- http://securitytracker.com/id?1015450
- http://www.osvdb.org/22294
- http://www.securityfocus.com/archive/1/421039/100/0/threaded
- http://www.securityfocus.com/bid/16161
- http://www.vupen.com/english/advisories/2006/0093
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24027
→ the Explorer · watch your stack · NVD