CVE-2006-3015

Argument injection vulnerability in WinSCP 3.8.1 build 328 allows remote attackers to upload or download arbitrary files via encoded spaces and double-quote characters in a scp or sftp URI.

• CWE-88

• http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0196.htmlBroken Link
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046810.htmlBroken Link, Exploit
• http://secunia.com/advisories/20575Broken Link, Vendor Advisory
• http://winscp.net/eng/docs/history#3.8.2Release Notes
• http://www.kb.cert.org/vuls/id/912588Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/18384Broken Link, Exploit, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2006/2289Broken Link
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27075Third Party Advisory, VDB Entry
• http://archives.neohapsis.com/archives/fulldisclosure/2006-06/0196.htmlBroken Link
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046810.htmlBroken Link, Exploit
• http://secunia.com/advisories/20575Broken Link, Vendor Advisory
• http://winscp.net/eng/docs/history#3.8.2Release Notes
• http://www.kb.cert.org/vuls/id/912588Third Party Advisory, US Government Resource
• http://www.securityfocus.com/bid/18384Broken Link, Exploit, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2006/2289Broken Link
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27075Third Party Advisory, VDB Entry

Published

Jun 14, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-3009Multiple cross-site scripting (XSS) vulnerabilities in Open …
• CVE-2006-3010Multiple SQL injection vulnerabilities in Open Business Mana…
• CVE-2006-3011The error_log function in basic_functions.c in PHP before 4.…
• CVE-2006-3012SQL injection vulnerability in phpBannerExchange before 2.0 …
• CVE-2006-3013Interpretation conflict in resetpw.php in phpBannerExchange …
• CVE-2006-3014Microsoft Excel allows user-assisted attackers to execute ar…
• CVE-2006-3016Unspecified vulnerability in session.c in PHP before 5.1.3 h…
• CVE-2006-3017zend_hash_del_key_or_index in zend_hash.c in PHP before 4.4.…
• CVE-2006-3018Unspecified vulnerability in the session extension functiona…
• CVE-2006-3019Multiple PHP remote file inclusion vulnerabilities in phpCMS…
• CVE-2006-3020Multiple cross-site scripting (XSS) vulnerabilities in FullP…
• CVE-2006-3021Multiple cross-site scripting (XSS) vulnerabilities in BlueC…