CVE-2006-1491 Code injection in n/a

What is CVE-2006-1491?

CVE-2006-1491 is a high-severity code injection vulnerability in n/a, published on 29 Mar 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Eval injection vulnerability in Horde Application Framework versions 3.0 before 3.0.10 and 3.1 before 3.1.1 allows remote attackers to execute arbitrary code via the help viewer.

Weakness: CWE-94

Which versions are affected by CVE-2006-1491?

It affects 1 product.

Products include Horde Application Framework.

How do I fix CVE-2006-1491?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2006-1491 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2006-1491 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in n/a

• CVE-2009-3701 Cross-site scripting in n/a Medium 4.3
• CVE-2009-4363 Cross-site scripting in n/a Medium 4.3
• CVE-2009-3236 File upload in n/a Medium 4.3
• CVE-2008-5917 Cross-site scripting in n/a Medium 4.3
• CVE-2004-2741 Cross-site scripting in n/a Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3r53-83gh-9p5m.