CVE-2006-2548

Prodder before 0.5, and perlpodder before 0.5, allows remote attackers to execute arbitrary code via shell metacharacters in the URL of a podcast (url attribute of an enclosure tag, or $enc_url variable), which is executed when running wget.

• CWE-94

• http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0567.html
• http://secunia.com/advisories/20208Patch, Vendor Advisory
• http://secunia.com/advisories/20238
• http://securityreason.com/securityalert/942
• http://sourceforge.net/project/shownotes.php?release_id=418189&group_id=148643Patch
• http://www.osvdb.org/25690
• http://www.redteam-pentesting.de/advisories/rt-sa-2006-002.phpExploit, Patch, Vendor Advisory
• http://www.redteam-pentesting.de/advisories/rt-sa-2006-003.phpExploit, Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/434712/100/0/threaded
• http://www.securityfocus.com/bid/18068Exploit, Patch
• http://www.vupen.com/english/advisories/2006/1905Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26568
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26575
• http://archives.neohapsis.com/archives/fulldisclosure/2006-05/0567.html
• http://secunia.com/advisories/20208Patch, Vendor Advisory
• http://secunia.com/advisories/20238
• http://securityreason.com/securityalert/942
• http://sourceforge.net/project/shownotes.php?release_id=418189&group_id=148643Patch
• http://www.osvdb.org/25690
• http://www.redteam-pentesting.de/advisories/rt-sa-2006-002.phpExploit, Patch, Vendor Advisory
• http://www.redteam-pentesting.de/advisories/rt-sa-2006-003.phpExploit, Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/434712/100/0/threaded
• http://www.securityfocus.com/bid/18068Exploit, Patch
• http://www.vupen.com/english/advisories/2006/1905Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26568
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26575

Published

May 23, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-2542xmcdconfig in xmcd for Debian GNU/Linux 2.6-17.1 creates /va…
• CVE-2006-2543Xtreme Topsites 1.1 allows remote attackers to trigger MySQL…
• CVE-2006-2544Multiple SQL injection vulnerabilities in Xtreme Topsites 1.…
• CVE-2006-2545Multiple cross-site scripting (XSS) vulnerabilities in Xtrem…
• CVE-2006-2546A recommended admin password reset mechanism for BEA WebLogi…
• CVE-2006-2547Unspecified vulnerability in the sapdba command in SAP with …
• CVE-2006-2549Stack-based buffer overflow in PDF Form Filling and Flatteni…
• CVE-2006-2550perlpodder before 0.5 allows remote attackers to execute arb…
• CVE-2006-2551Unspecified vulnerability in the kernel in HP-UX B.11.00 all…
• CVE-2006-2552Jemscripts DownloadControl 1.0 allows remote attackers to ob…
• CVE-2006-2553Cross-site scripting (XSS) vulnerability in Jemscripts Downl…
• CVE-2006-2554Buffer overflow in the tell_player_surr_changes function in …