CVE-2007-6566

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-12-28 · updated 2026-06-16
Weakness: CWE-89

Description

SQL injection vulnerability in post.php in XZero Community Classifieds 4.95.11 and earlier allows remote attackers to execute arbitrary SQL commands via the subcatid parameter to index.php.

Affected products

Xzero Scripts Xzero Community Classifieds: 4.95.11

References

http://en.rstzone.org/xzero-community-classifieds-v4-95-11-lfi-sql-in-t9394.rst
http://osvdb.org/39740
http://secunia.com/advisories/28250
http://www.securityfocus.com/archive/1/485545/100/0/threaded
http://www.securityfocus.com/bid/27042
https://exchange.xforce.ibmcloud.com/vulnerabilities/39259
https://www.exploit-db.com/exploits/4794
http://en.rstzone.org/xzero-community-classifieds-v4-95-11-lfi-sql-in-t9394.rst
http://osvdb.org/39740
http://secunia.com/advisories/28250
http://www.securityfocus.com/archive/1/485545/100/0/threaded
http://www.securityfocus.com/bid/27042

Get alerted when CVE-2007-6566 or the next vulnerability affects your stack