CVE-2006-4754

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-09-13 · updated 2026-06-16

Description

Cross-site scripting (XSS) vulnerability in index.php in PHProg before 1.1 allows remote attackers to inject arbitrary web script or HTML via the album parameter, which is used in an opendir call. NOTE: the same primary issue can be used for full path disclosure with an invalid parameter that reveals the installation path in an error message.

Affected products

Comscripts Phprog: 1.0

References

http://marc.info/?l=full-disclosure&m=115796646100433&w=2
http://secunia.com/advisories/21849
http://www.comscripts.com/scripts/php.phprog-album-photo-php.2117.html
http://www.pconfig.com/cdg393/adviso/PHProg.txt
http://www.securityfocus.com/bid/19957
https://exchange.xforce.ibmcloud.com/vulnerabilities/28845
https://exchange.xforce.ibmcloud.com/vulnerabilities/28846
http://marc.info/?l=full-disclosure&m=115796646100433&w=2
http://secunia.com/advisories/21849
http://www.comscripts.com/scripts/php.phprog-album-photo-php.2117.html
http://www.pconfig.com/cdg393/adviso/PHProg.txt
http://www.securityfocus.com/bid/19957

Get alerted when CVE-2006-4754 or the next vulnerability affects your stack