Evil-DB LogoEvil-DB
← All CVEs

CVE-2006-1260

medium · 5

Horde Application Framework 3.0.9 allows remote attackers to read arbitrary files via a null character in the url parameter in services/go.php, which bypasses a sanity check.

5
CVSS
12.5%
EPSS (exploit prob.)
96th
EPSS percentile
2006-03-19
Published

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

VendorProductAffected versions
hordehorde1.2
hordehorde1.2.1
hordehorde1.2.2
hordehorde1.2.3
hordehorde1.2.4
hordehorde1.2.5
hordehorde1.2.6
hordehorde1.2.7
hordehorde1.2.8
hordehorde2.0
hordehorde2.1
hordehorde2.1.3
hordehorde2.2
hordehorde2.2.1
hordehorde2.2.3
hordehorde2.2.4
hordehorde2.2.4_rc1
hordehorde2.2.5
hordehorde2.2.6
hordehorde2.2.7
hordehorde2.2.8
hordehorde2.2.9
hordehorde3.0
hordehorde3.0.1
hordehorde3.0.2
hordehorde3.0.3
hordehorde3.0.4
hordehorde3.0.4_rc1
hordehorde3.0.4_rc2
hordehorde3.0.6
hordehorde3.0.7
hordehorde3.0.8
hordehorde3.0.9

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2006-1260