CVE-2006-1676
SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro (MD-Pro...
CVE-2006-1676 is a medium vulnerability (CVSS 6.4) in Maxdev Md-pro, published April 10, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 1.22%, the 68th percentile. No source names a fixed version.
SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro (MD-Pro) 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not properly handled in PNuserapi.PHP.
Exploit likelihood
What each source reports
NVD Score used
SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro (MD-Pro) 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not properly handled in PNuserapi.PHP.
- Record
CVE-2006-1676- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro (MD-Pro) 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not properly handled in PNuserapi.PHP.
- Record
CVE-2006-1676- Updated
- 2026-11-02
EUVDEUVD-2006-1677 No score
SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro (MD-Pro) 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not properly handled in PNuserapi.PHP.
- Record
EUVD-2006-1677- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cv7v-fxjm-m85x No score
SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro (MD-Pro...
SQL injection vulnerability in the display function in the Topics module for MAXdev MDPro (MD-Pro) 1.0.73 and 1.0.72, and possibly other versions before 1.076, allows remote attackers to execute arbitrary SQL commands via the topicid parameter in a display action, which is not properly handled in PNuserapi.PHP.
- Record
GHSA-cv7v-fxjm-m85x- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | MAXDEV CMS 1.0.72/1.0.73 - 'PNuserapi.php' SQL Injection | 2006-04-06 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD |
References
securityfocus.com/bid/17399
maxdev.com/Article592.phtml
exchange.xforce.ibmcloud.com/vulnerabilities/25710
secunia.com/advisories/19578
vupen.com/english/advisories/2006/1282
nvd.nist.gov/vuln/detail/CVE-2006-1676
github.com/advisories/GHSA-cv7v-fxjm-m85x