CVE-2006-0754
** DISPUTED ** dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive...
CVE-2006-0754 is a medium vulnerability (CVSS 5.0) in Dotproject, published February 18, 2006. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.76%, the 78th percentile.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 1.76%EPSS, 78th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php
Exploit likelihood
Affected products
What each source reports
NVD Score used
dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php
- Record
CVE-2006-0754- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE ListNo score
dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php
- Record
CVE-2006-0754- Updated
- 2026-11-02
EUVDEUVD-2006-0760No score
dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php
- Record
EUVD-2006-0760- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-87jh-5fgc-6gfrNo score
** DISPUTED ** dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive...
** DISPUTED ** dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignores the installation instructions as well as warnings generated by check.php.
- Record
GHSA-87jh-5fgc-6gfr- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
osvdb.org/23206
securityfocus.com/archive/1/424957/100/0/threaded
exchange.xforce.ibmcloud.com/vulnerabilities/24745
secunia.com/advisories/18879
vupen.com/english/advisories/2006/0604
nvd.nist.gov/vuln/detail/CVE-2006-0754
github.com/advisories/GHSA-87jh-5fgc-6gfr