CVE-2006-2878

The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by preg_replace with the /e (executable) modifier.

• http://bugs.splitbrain.org/index.php?do=details&id=823Patch
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046602.html
• http://secunia.com/advisories/20429Patch, Vendor Advisory
• http://secunia.com/advisories/20669Vendor Advisory
• http://securitytracker.com/id?1016221
• http://www.gentoo.org/security/en/glsa/glsa-200606-16.xml
• http://www.hardened-php.net/advisory_042006.119.htmlPatch, Vendor Advisory
• http://www.osvdb.org/25980
• http://www.securityfocus.com/archive/1/435989/100/0/threaded
• http://www.securityfocus.com/bid/18289
• http://www.vupen.com/english/advisories/2006/2142
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26913
• http://bugs.splitbrain.org/index.php?do=details&id=823Patch
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046602.html
• http://secunia.com/advisories/20429Patch, Vendor Advisory
• http://secunia.com/advisories/20669Vendor Advisory
• http://securitytracker.com/id?1016221
• http://www.gentoo.org/security/en/glsa/glsa-200606-16.xml
• http://www.hardened-php.net/advisory_042006.119.htmlPatch, Vendor Advisory
• http://www.osvdb.org/25980
• http://www.securityfocus.com/archive/1/435989/100/0/threaded
• http://www.securityfocus.com/bid/18289
• http://www.vupen.com/english/advisories/2006/2142
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26913

Published

Jun 7, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-2872PHP remote file inclusion vulnerability in config.php in Rum…
• CVE-2006-2873Cross-site scripting (XSS) vulnerability in hava.asp in Enig…
• CVE-2006-2874Unspecified vulnerability in OSADS Alliance Database before …
• CVE-2006-2875Stack-based buffer overflow in the CL_ParseDownload function…
• CVE-2006-2876Cross-site scripting (XSS) vulnerability in cat.php in PHP P…
• CVE-2006-2877PHP remote file inclusion vulnerability in Bookmark4U 2.0.0 …
• CVE-2006-2879SQL injection vulnerability in newscomments.php in Alex News…
• CVE-2006-2880Cross-site scripting (XSS) vulnerability in the Contributed …
• CVE-2006-2881Multiple PHP remote file inclusion vulnerabilities in DreamA…
• CVE-2006-2882Multiple cross-site scripting (XSS) vulnerabilities submit.a…
• CVE-2006-2883Cross-site scripting (XSS) vulnerability in search.php in Km…
• CVE-2006-2884SQL injection vulnerability in index.php in Kmita FAQ 1.0 al…