CVE-2006-5085
Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 allows remote...
CVE-2006-5085 is a high vulnerability (CVSS 7.5) in Pixel Motion Blog, published September 29, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 47.0%, the 98th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 47.0%EPSS, 98th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 allows remote attackers to execute arbitrary PHP code via the nom_blog parameter, which is injected into include/variables.php.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Blog Pixel Motion 2.1.1 - PHP Code Execution / Create Admin | 2006-09-27 |
What each source reports
NVD Score used
Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 allows remote attackers to execute arbitrary PHP code via the nom_blog parameter, which is injected into include/variables.php.
- Record
CVE-2006-5085- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 allows remote attackers to execute arbitrary PHP code via the nom_blog parameter, which is injected into include/variables.php.
- Record
CVE-2006-5085- Updated
- 2026-11-02
EUVDEUVD-2006-5070No score
Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 allows remote attackers to execute arbitrary PHP code via the nom_blog parameter, which is injected into include/variables.php.
- Record
EUVD-2006-5070- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7jg6-w47h-465gNo score
Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 allows remote...
Static code injection vulnerability in config.php in Blog Pixel Motion 2.1.1 allows remote attackers to execute arbitrary PHP code via the nom_blog parameter, which is injected into include/variables.php.
- Record
GHSA-7jg6-w47h-465g- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
secunia.com/advisories/22163
exchange.xforce.ibmcloud.com/vulnerabilities/29217
securityfocus.com/bid/20235
acid-root.new.fr/poc/12060927.txt
securityreason.com/securityalert/1653
nvd.nist.gov/vuln/detail/CVE-2006-5085
github.com/advisories/GHSA-7jg6-w47h-465g