CVE-2006-2826

SQL injection vulnerability in sessions.inc in PHP Base Library (PHPLib) before 7.4a allows remote attackers to execute arbitrary SQL commands via the id variable, which is set by a client through a query string or a cookie.

• http://secunia.com/advisories/16902Patch, Vendor Advisory
• http://securitytracker.com/id?1016123Patch
• http://sourceforge.net/project/shownotes.php?group_id=31885&release_id=396091Patch
• http://www.gulftech.org/?node=research&article_id=00107-03052006Vendor Advisory
• http://www.osvdb.org/23466Patch
• http://www.securityfocus.com/bid/16801Patch
• http://www.vupen.com/english/advisories/2006/0720
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24873
• http://secunia.com/advisories/16902Patch, Vendor Advisory
• http://securitytracker.com/id?1016123Patch
• http://sourceforge.net/project/shownotes.php?group_id=31885&release_id=396091Patch
• http://www.gulftech.org/?node=research&article_id=00107-03052006Vendor Advisory
• http://www.osvdb.org/23466Patch
• http://www.securityfocus.com/bid/16801Patch
• http://www.vupen.com/english/advisories/2006/0720
• https://exchange.xforce.ibmcloud.com/vulnerabilities/24873

Published

Jun 5, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-2820Cross-site scripting (XSS) vulnerability in HotWebScripts.co…
• CVE-2006-2821Multiple cross-site scripting (XSS) vulnerabilities in Delta…
• CVE-2006-2822SQL injection vulnerability in admin/default.asp in Dusan Dr…
• CVE-2006-2823Katrien De Graeve a.shopKart 2.0 (aka ashopKart20) stores se…
• CVE-2006-2824Logicalware MailManager before 2.0.10 does not remove 0xc8 0…
• CVE-2006-2825cPanel does not automatically synchronize the PHP open_based…
• CVE-2006-2827SQL injection vulnerability in search.php in X-Cart Gold and…9.8
• CVE-2006-2828Global variable overwrite vulnerability in PHP-Nuke allows r…
• CVE-2006-2829Buffer overflow in Hawk Monitoring Agent (HMA) for TIBCO Haw…
• CVE-2006-2830Buffer overflow in TIBCO Rendezvous before 7.5.1, TIBCO Runt…
• CVE-2006-2831Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, when runni…
• CVE-2006-2832Cross-site scripting (XSS) vulnerability in the upload modul…