CVE-2006-0754
** DISPUTED ** dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive...
dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php
Exploit likelihood
What each source reports
NVD Score used
dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php
- Record
CVE-2006-0754- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php
- Record
CVE-2006-0754- Updated
- 2026-11-02
EUVDEUVD-2006-0760 No score
dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php
- Record
EUVD-2006-0760- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-87jh-5fgc-6gfr No score
** DISPUTED ** dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive...
** DISPUTED ** dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php.
- Record
GHSA-87jh-5fgc-6gfr- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-0754 is a medium vulnerability (CVSS 5.0) in Dotproject, published February 18, 2006. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.76%, the 78th percentile.
References
osvdb.org/23206
securityfocus.com/archive/1/424957/100/0/threaded
exchange.xforce.ibmcloud.com/vulnerabilities/24745
secunia.com/advisories/18879
vupen.com/english/advisories/2006/0604
nvd.nist.gov/vuln/detail/CVE-2006-0754
github.com/advisories/GHSA-87jh-5fgc-6gfr