CVE-2006-0806

Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages...

4.3 MediumPublic exploitFix available

Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via (1) the next_page parameter in adodb-pager.inc.php and (2) other unspecified vectors related to PHP_SELF.

Exploit likelihood

6.01%Down 15.9 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2006-0806
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2006-0806
Updated: 2026-11-02

EUVDEUVD-2006-0812 No score

Record: EUVD-2006-0812
Updated: 2026-11-03

GitHub AdvisoriesGHSA-44cj-54hp-jr6f No score

Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages...

Record: GHSA-44cj-54hp-jr6f
Weakness: CWE-79
Updated: 2026-11-02

OSV No score

Record: CVE-2006-0806
Updated: 2026-11-02

OSVDEBIAN-CVE-2006-0806 No score

Record: DEBIAN-CVE-2006-0806
Updated: 2026-11-02

Affected products

john lim adodb

Affected packages

Affected packages
Package	Affected	Fixed
`cacti` Debian:12	before 0.8.6d-1	0.8.6d-1
`cacti` Debian:13	before 0.8.6d-1	0.8.6d-1
`cacti` Debian:14	before 0.8.6d-1	0.8.6d-1
`libphp-adodb` Debian:12	before 4.72-0.1	4.72-0.1
`libphp-adodb` Debian:13	before 4.72-0.1	4.72-0.1
`libphp-adodb` Debian:14	before 4.72-0.1	4.72-0.1
`libphp-adodb` Debian:3.0 From an advisory covering 4 CVEs	before 1.51-1.2, plus listed versions 1.51-1.1	1.51-1.2
`libphp-adodb` Debian:3.1 From an advisory covering 4 CVEs	before 4.52-1sarge1, plus listed versions 4.52-1	4.52-1sarge1
`moodle` Debian:3.1 From an advisory covering 4 CVEs	before 1.4.4.dfsg.1-3sarge1, plus listed versions 1.4.4.dfsg.1-3	1.4.4.dfsg.1-3sarge1
`cacti` Debian:3.1 From an advisory covering 4 CVEs	before 0.8.6c-7sarge3, plus listed versions 0.8.6c-70.8.6c-7sarge2	0.8.6c-7sarge3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	ADOdb < 4.71 - Cross Site Scripting	2016-02-18

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-0806 is a medium vulnerability (CVSS 4.3) in John Lim Adodb, published February 21, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 6.01%, the 93rd percentile. Fixed in cacti 0.8.6d-1.

References

Show 15 moreShow less