CVE-2006-3016: php group php
- 1 reference with an unsupported link type was hidden.
Vulnerability summary
CVE-2006-3016 is a high (CVSS 9.3) vulnerability in php group php. EPSS estimates a 2.54% chance of exploitation in the next 30 days, higher than 85% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 14-06-2006PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to "certain characters in session names," including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities. NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name().
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
2.54%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.54% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (securityfocus.com)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.
Php group1 product
- php≤ 5.1.2
1 vendor · 1 product
References
23 links- issues.rpath.com/browse/RPL-683X Refsource CONFIRM
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10597VDB EntrySignatureX Refsource OVAL
- support.avaya.com/elmodocs2/security/ASA-2006-221.htmX Refsource CONFIRM
- support.avaya.com/elmodocs2/security/ASA-2006-222.htmX Refsource CONFIRM
Show all 23 references
- www.php.net/release_5_1_3.phpX Refsource CONFIRM