CVE-2006-6943

N/A Unknown
Published: January 19, 2007 Modified: April 23, 2026
View on NVD

Description

PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain the full server path via direct requests to (a) scripts/check_lang.php and (b) themes/darkblue_orange/layout.inc.php; and via the (1) lang[], (2) target[], (3) db[], (4) goto[], (5) table[], and (6) tbl_group[] array arguments to (c) index.php, and the (7) back[] argument to (d) sql.php; and an invalid (8) sort_by parameter to (e) server_databases.php and (9) db parameter to (f) db_printview.php.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://marc.info/?l=bugtraq&m=116370414309444&w=2
Source: cve@mitre.org
Third Party Advisory
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8
Source: cve@mitre.org
Patch Vendor Advisory
http://www.securityfocus.com/bid/21137
Source: cve@mitre.org
Third Party Advisory VDB Entry
http://marc.info/?l=bugtraq&m=116370414309444&w=2
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-8
Source: af854a3a-2127-422b-91ae-364da2661108
Patch Vendor Advisory
http://www.securityfocus.com/bid/21137
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory VDB Entry

6 reference(s) from NVD

Quick Stats

CVSS v3 Score
N/A / 10.0
EPSS (Exploit Probability)
11.5%
94th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-20

Affected Vendors

phpmyadmin

Related CVEs

CVE-2026-42615 7.2
CVE-2026-23773 4.3
CVE-2026-40560 N/A
CVE-2026-7363 N/A
CVE-2026-7361 N/A