CVE-2006-6942

Multiple cross-site scripting (XSS) vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via (1) a comment for a table name, as exploited through (a) db_operations.php, (2) the db parameter to (b) db_create.php, (3) the newname parameter to db_operations.php, the (4) query_history_latest, (5) query_history_latest_db, and (6) querydisplay_tab parameters to (c) querywindow.php, and (7) the pos parameter to (d) sql.php.

• CWE-79

• http://marc.info/?l=bugtraq&m=116370414309444&w=2Third Party Advisory
• http://secunia.com/advisories/26733Permissions Required
• http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-7Patch, Vendor Advisory
• http://www.securityfocus.com/bid/21137Third Party Advisory, VDB Entry
• http://www.us.debian.org/security/2007/dsa-1370Third Party Advisory
• http://www.vupen.com/english/advisories/2006/4572Not Applicable
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30310
• http://marc.info/?l=bugtraq&m=116370414309444&w=2Third Party Advisory
• http://secunia.com/advisories/26733Permissions Required
• http://www.phpmyadmin.net/home_page/security.php?issue=PMASA-2006-7Patch, Vendor Advisory
• http://www.securityfocus.com/bid/21137Third Party Advisory, VDB Entry
• http://www.us.debian.org/security/2007/dsa-1370Third Party Advisory
• http://www.vupen.com/english/advisories/2006/4572Not Applicable
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30310

Published

Jan 19, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-6936Cross-site scripting (XSS) vulnerability in Xtreme ASP Photo…
• CVE-2006-6937SQL injection vulnerability in displaypic.asp in Xtreme ASP …
• CVE-2006-6938Directory traversal vulnerability in includes/common.php in …
• CVE-2006-6939GNU ed before 0.3 allows local users to overwrite arbitrary …
• CVE-2006-6940Buffer overflow in the ParseHeader function in clsOWA.cls in…
• CVE-2006-6941index.php in FreeWebshop 2.2.2 and earlier allows remote att…
• CVE-2006-6943PhpMyAdmin before 2.9.1.1 allows remote attackers to obtain …
• CVE-2006-6944phpMyAdmin before 2.9.1.1 allows remote attackers to bypass …
• CVE-2006-6945SQL injection vulnerability in Virtuemart 1.0.7 allows remot…
• CVE-2006-6946The web server in the NEC MultiWriter 1700C allows remote at…
• CVE-2006-6947The FTP server in the NEC MultiWriter 1700C allows remote at…
• CVE-2006-6948MyODBC Japanese conversion edition 3.51.06, 2.50.29, and 2.5…