CVE-2006-6112

LifeType 1.0.x and 1.1.x have insufficient access control for all of the PHP scripts under (1) class/ and (2) plugins/, which allows remote attackers to obtain the installation path via a direct request to any of the scripts, as demonstrated by (a) bayesianfilter.class.php and (b) bootstrap.php, which leaks the path in an error message.

• http://securityreason.com/securityalert/1980
• http://www.lifetype.net/blog.php/lifetype-development-journal/2006/11/30/full_path_disclosure_vulnerability_in_lifetype_1.0.x_and_1.1.xPatch, Vendor Advisory
• http://www.netvigilance.com/advisory0008Exploit, Patch, Vendor Advisory
• http://www.osvdb.org/30685Vendor Advisory
• http://www.securityfocus.com/archive/1/453135/100/0/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30635
• http://securityreason.com/securityalert/1980
• http://www.lifetype.net/blog.php/lifetype-development-journal/2006/11/30/full_path_disclosure_vulnerability_in_lifetype_1.0.x_and_1.1.xPatch, Vendor Advisory
• http://www.netvigilance.com/advisory0008Exploit, Patch, Vendor Advisory
• http://www.osvdb.org/30685Vendor Advisory
• http://www.securityfocus.com/archive/1/453135/100/0/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30635

Published

Dec 6, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-6106Multiple buffer overflows in the cmtp_recv_interopmsg functi…
• CVE-2006-6107Unspecified vulnerability in the match_rule_equal function i…
• CVE-2006-6108Cross-site scripting (XSS) vulnerability in EC-CUBE before 1…
• CVE-2006-6109Multiple SQL injection vulnerabilities in CandyPress Store 3…
• CVE-2006-6110Multiple SQL injection vulnerabilities in an unspecified BPG…
• CVE-2006-6111Multiple SQL injection vulnerabilities in Alan Ward A-Cart P…
• CVE-2006-6113Monkey Boards 0.3.5 allows remote attackers to obtain sensit…
• CVE-2006-6114Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2006-6115SQL injection vulnerability in index.asp in fipsCMS 4.5 and …
• CVE-2006-6116SQL injection vulnerability in default2.asp in fipsForum 2.6…
• CVE-2006-6117SQL injection vulnerability in index1.asp in fipsGallery 1.5…
• CVE-2006-6118Cross-site scripting (XSS) vulnerability in thumbs.php in mm…