Every CVE Search/ Get API key

CVE-2006-1490

PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary...

5.0 MediumPublic exploit

PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents.

Exploit likelihood

21.0%Up 8.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents.

Record
CVE-2006-1490
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Updated
2026-11-02
CVE List No score

PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents.

Record
CVE-2006-1490
Updated
2026-11-02
EUVDEUVD-2006-1494 No score

PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents.

Record
EUVD-2006-1494
Updated
2026-11-03
GitHub AdvisoriesGHSA-fc4p-x25r-c4jr No score

PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary...

PHP before 5.1.3-RC1 might allow remote attackers to obtain portions of memory via crafted binary data sent to a script that processes user input in the html_entity_decode function and sends the encoded results back to the client, aka a "binary safety" issue. NOTE: this issue has been referred to as a "memory leak," but it is an information leak that discloses memory contents.

Record
GHSA-fc4p-x25r-c4jr
Updated
2026-11-02
OSVBELL-CVE-2006-1490 5.0

CVE-2006-1490 does not affect BellSoft software

Record
BELL-CVE-2006-1490
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2024:11167-1 No score

php7-7.4.24-1.1 on GA media

These are all security issues fixed in the php7-7.4.24-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11167-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11169-1 No score

php8-8.0.11-1.1 on GA media

These are all security issues fixed in the php8-8.0.11-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11169-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
php
Red Hat:enterprise_linux:3::as
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-debuginfo
Red Hat:enterprise_linux:3::as
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-devel
Red Hat:enterprise_linux:3::as
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-imap
Red Hat:enterprise_linux:3::as
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-ldap
Red Hat:enterprise_linux:3::as
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-mysql
Red Hat:enterprise_linux:3::as
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-odbc
Red Hat:enterprise_linux:3::as
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-pgsql
Red Hat:enterprise_linux:3::as
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php
Red Hat:enterprise_linux:3::desktop
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-debuginfo
Red Hat:enterprise_linux:3::desktop
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
Show 84 moreShow less
Affected packages
PackageAffectedFixed
php-devel
Red Hat:enterprise_linux:3::desktop
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-imap
Red Hat:enterprise_linux:3::desktop
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-ldap
Red Hat:enterprise_linux:3::desktop
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-mysql
Red Hat:enterprise_linux:3::desktop
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-odbc
Red Hat:enterprise_linux:3::desktop
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-pgsql
Red Hat:enterprise_linux:3::desktop
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php
Red Hat:enterprise_linux:3::es
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-debuginfo
Red Hat:enterprise_linux:3::es
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-devel
Red Hat:enterprise_linux:3::es
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-imap
Red Hat:enterprise_linux:3::es
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-ldap
Red Hat:enterprise_linux:3::es
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-mysql
Red Hat:enterprise_linux:3::es
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-odbc
Red Hat:enterprise_linux:3::es
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-pgsql
Red Hat:enterprise_linux:3::es
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php
Red Hat:enterprise_linux:3::ws
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-debuginfo
Red Hat:enterprise_linux:3::ws
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-devel
Red Hat:enterprise_linux:3::ws
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-imap
Red Hat:enterprise_linux:3::ws
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-ldap
Red Hat:enterprise_linux:3::ws
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-mysql
Red Hat:enterprise_linux:3::ws
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-odbc
Red Hat:enterprise_linux:3::ws
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php-pgsql
Red Hat:enterprise_linux:3::ws
From an advisory covering 6 CVEs
 before 0:4.3.2-30.ent
0:4.3.2-30.ent
php
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-debuginfo
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-devel
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-domxml
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-gd
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-imap
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-ldap
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-mbstring
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-mysql
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-ncurses
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-odbc
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-pear
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-pgsql
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-snmp
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-xmlrpc
Red Hat:enterprise_linux:4::as
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-debuginfo
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-devel
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-domxml
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-gd
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-imap
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-ldap
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-mbstring
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-mysql
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-ncurses
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-odbc
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-pear
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-pgsql
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-snmp
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-xmlrpc
Red Hat:enterprise_linux:4::desktop
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-debuginfo
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-devel
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-domxml
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-gd
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-imap
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-ldap
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-mbstring
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-mysql
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-ncurses
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-odbc
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-pear
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-pgsql
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-snmp
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-xmlrpc
Red Hat:enterprise_linux:4::es
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-debuginfo
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-devel
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-domxml
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-gd
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-imap
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-ldap
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-mbstring
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-mysql
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-ncurses
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-odbc
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-pear
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-pgsql
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-snmp
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php-xmlrpc
Red Hat:enterprise_linux:4::ws
From an advisory covering 6 CVEs
 before 0:4.3.9-3.12
0:4.3.9-3.12
php7
openSUSE:Tumbleweed
From an advisory covering 44 CVEs
 before 7.4.24-1.1
7.4.24-1.1
php8
openSUSE:Tumbleweed
From an advisory covering 97 CVEs
 before 8.0.11-1.1
8.0.11-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPHP 4.x/5.x - 'Html_Entity_Decode()' Information Disclosure2006-03-29

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-1490 is a medium vulnerability (CVSS 5.0) in Php, published March 29, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 21.0%, the 97th percentile. No source names a fixed version.

References

Show 158 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open