{"id":"CVE-2006-4592","aliases":["EUVD-2006-4580","GHSA-wr42-4v57-8jp9"],"status":"published","title":"Incomplete blacklist vulnerability in default.asp in 8pixel.net Simple Blog 2.3 and earlier...","description":"Incomplete blacklist vulnerability in default.asp in 8pixel.net Simple Blog 2.3 and earlier allows remote attackers to conduct SQL injection attacks via \"\u003e\" characters in the id parameter, which are not filtered by the protection mechanism.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01251,"percentile":0.69609,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2006-09-06T22:00:00Z","modified":"2026-06-16T22:29:24Z","exploits":[{"source":"exploitdb","id":"EDB-2296","title":"SimpleBlog 2.3 - 'id' SQL Injection","type":"webapps","platform":"asp","date":"2006-09-04","verified":true,"url":"https://www.exploit-db.com/exploits/2296"}],"products":[{"vendor":"8pixel.net","product":"simple_blog"}],"references":[{"url":"http://secunia.com/advisories/21755","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/2296","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"http://www.osvdb.org/28541","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2006/3451","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://www.securityfocus.com/bid/19848","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit"]},{"url":"http://securitytracker.com/id?1016793","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-4592"},{"url":"https://github.com/advisories/GHSA-wr42-4v57-8jp9"}],"sources":{"cve":[{"id":"CVE-2006-4592","description":"Incomplete blacklist vulnerability in default.asp in 8pixel.net Simple Blog 2.3 and earlier allows remote attackers to conduct SQL injection attacks via \"\u003e\" characters in the id parameter, which are not filtered by the protection mechanism.","status":"published","published":"2006-09-06T22:00:00Z","modified":"2024-08-07T19:14:47.565Z","updated_at":"2026-11-02T14:33:51.470623Z"}],"euvd":[{"id":"EUVD-2006-4580","description":"Incomplete blacklist vulnerability in default.asp in 8pixel.net Simple Blog 2.3 and earlier allows remote attackers to conduct SQL injection attacks via \"\u003e\" characters in the id parameter, which are not filtered by the protection mechanism.","status":"published","published":"2006-09-06T22:00:00Z","modified":"2024-08-07T19:14:47Z","updated_at":"2026-11-03T01:15:51.316983Z"}],"ghsa":[{"id":"GHSA-wr42-4v57-8jp9","title":"Incomplete blacklist vulnerability in default.asp in 8pixel.net Simple Blog 2.3 and earlier...","description":"Incomplete blacklist vulnerability in default.asp in 8pixel.net Simple Blog 2.3 and earlier allows remote attackers to conduct SQL injection attacks via \"\u003e\" characters in the id parameter, which are not filtered by the protection mechanism.","status":"published","published":"2022-05-01T07:20:04Z","modified":"2023-01-31T05:01:59Z","updated_at":"2026-11-02T14:48:10.096738Z"}],"nvd":[{"id":"CVE-2006-4592","description":"Incomplete blacklist vulnerability in default.asp in 8pixel.net Simple Blog 2.3 and earlier allows remote attackers to conduct SQL injection attacks via \"\u003e\" characters in the id parameter, which are not filtered by the protection mechanism.","status":"published","published":"2006-09-06T22:04:00Z","modified":"2026-06-16T22:29:24.68Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:01:05.928789Z"}]}}