CVE-2006-3105
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response...
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.
Exploit likelihood
What each source reports
NVD Score used
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.
- Record
CVE-2006-3105- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.
- Record
CVE-2006-3105- Updated
- 2026-11-02
EUVDEUVD-2006-3102 No score
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.
- Record
EUVD-2006-3102- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r6x4-g6mq-2ww5 No score
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response...
CRLF injection vulnerability in Bitweaver 1.3 allows remote attackers to conduct HTTP response splitting attacks by via CRLF sequences in multiple unspecified parameters that are injected into HTTP headers, as demonstrated by the BWSESSION parameter in index.php.
- Record
GHSA-r6x4-g6mq-2ww5- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Bitweaver 1.3 - 'tmpImagePath' Attachment mod_mime | 2006-06-15 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3105 is a medium vulnerability (CVSS 5.0) in Bitweaver, published June 21, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 2.67%, the 85th percentile. No source names a fixed version.
References
sourceforge.net/project/shownotes.php?release_id=336854&group_id=141358
retrogod.altervista.org/bitweaver_13_xpl.html
osvdb.org/26590
bitweaver.org/articles/45
securityreason.com/securityalert/1115
exchange.xforce.ibmcloud.com/vulnerabilities/27348
securityfocus.com/archive/1/437491/100/0/threaded
nvd.nist.gov/vuln/detail/CVE-2006-3105
github.com/advisories/GHSA-r6x4-g6mq-2ww5