{"id":"CVE-2006-6846","aliases":["EUVD-2006-6829","GHSA-xh9p-p9h3-4958"],"status":"published","title":"Multiple SQL injection vulnerabilities in While You Were Out (WYWO) InOut Board 1.0 allow remote...","description":"Multiple SQL injection vulnerabilities in While You Were Out (WYWO) InOut Board 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the num parameter in (a) phonemessage.asp, (2) the catcode parameter in (b) faqDsp.asp, and the (3) Username and (4) Password fields in (c) login.asp.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0108,"percentile":0.65327,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2006-12-31T05:00:00Z","modified":"2026-06-16T22:33:54Z","exploits":[{"source":"exploitdb","id":"EDB-3032","title":"wywo inout board 1.0 - Multiple Vulnerabilities","type":"webapps","platform":"asp","date":"2006-12-28","verified":true,"url":"https://www.exploit-db.com/exploits/3032"}],"products":[{"vendor":"cybercoded","product":"while_you_were_out_inout_board"}],"references":[{"url":"http://secunia.com/advisories/23571","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.securityfocus.com/bid/21803","tags":["vdb-entry","x_refsource_BID","x_transferred","Exploit"]},{"url":"https://www.exploit-db.com/exploits/3032","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31128","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-6846"},{"url":"https://github.com/advisories/GHSA-xh9p-p9h3-4958"}],"sources":{"cve":[{"id":"CVE-2006-6846","description":"Multiple SQL injection vulnerabilities in While You Were Out (WYWO) InOut Board 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the num parameter in (a) phonemessage.asp, (2) the catcode parameter in (b) faqDsp.asp, and the (3) Username and (4) Password fields in (c) login.asp.","status":"published","published":"2007-01-03T02:00:00Z","modified":"2024-08-07T20:42:07.641Z","updated_at":"2026-11-02T14:33:50.738595Z"}],"euvd":[{"id":"EUVD-2006-6829","description":"Multiple SQL injection vulnerabilities in While You Were Out (WYWO) InOut Board 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the num parameter in (a) phonemessage.asp, (2) the catcode parameter in (b) faqDsp.asp, and the (3) Username and (4) Password fields in (c) login.asp.","status":"published","published":"2007-01-03T02:00:00Z","modified":"2024-08-07T20:42:07Z","updated_at":"2026-11-03T01:15:41.522555Z"}],"ghsa":[{"id":"GHSA-xh9p-p9h3-4958","title":"Multiple SQL injection vulnerabilities in While You Were Out (WYWO) InOut Board 1.0 allow remote...","description":"Multiple SQL injection vulnerabilities in While You Were Out (WYWO) InOut Board 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the num parameter in (a) phonemessage.asp, (2) the catcode parameter in (b) faqDsp.asp, and the (3) Username and (4) Password fields in (c) login.asp.","status":"published","published":"2022-05-01T07:42:00Z","modified":"2023-01-31T05:03:07Z","updated_at":"2026-11-02T14:48:24.116172Z"}],"nvd":[{"id":"CVE-2006-6846","description":"Multiple SQL injection vulnerabilities in While You Were Out (WYWO) InOut Board 1.0 allow remote attackers to execute arbitrary SQL commands via (1) the num parameter in (a) phonemessage.asp, (2) the catcode parameter in (b) faqDsp.asp, and the (3) Username and (4) Password fields in (c) login.asp.","status":"published","published":"2006-12-31T05:00:00Z","modified":"2026-06-16T22:33:54.97Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:01:10.726159Z"}]}}