$ cve CVE-2006-0759 JSON

CVE-2006-0759 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 1.8% (pctl 78)

Patch early

A public exploit exists.

Description

Multiple SQL injection vulnerabilities in HiveMail 1.3 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the contactgroupid parameter in addressbook.update.php, (2) the messageid parameter in addressbook.add.php, (3) the folderid parameter in folders.update.php, and possibly certain parameters in (4) calendar.event.php, (5) index.php, (6) pop.download.php, (7) read.bounce.php, (8) rules.block.php, (9) language.php, and (10) certain other scripts; and allow remote authenticated users to execute arbitrary SQL commands via (11) the folderid parameter in index.php and (12) possibly other parameters in certain other scripts, because $_SERVER['PHP_SELF'] is improperly handled.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	1.85% — more likely to be exploited than 78% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-02-18
Last modified	2026-06-16

Affected (1)

Vendor	Product
hivemail	hivemail

Public exploits

Source	Title	Date
exploit-db	HiveMail 1.3 - 'addressbook.add.php' Remote Code Execution	2006-05-06

References

→ the Explorer · watch your stack · NVD