UnratedFix available
cacti, libphp-adodb — security advisory
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
- Products
- cacti, libphp-adodb
- Affected versions
- Not specified
- Fixed versions
- 0.8.6d-1, 4.72-0.1
- CVEs
- CVE-2006-0146
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 20:13 UTC · Revision 1
Source evidence
The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.
osv:DEBIAN-CVE-2006-0146
cacti
Fixed versions: 0.8.6d-1
cacti
Fixed versions: 0.8.6d-1
cacti
Fixed versions: 0.8.6d-1
libphp-adodb
Fixed versions: 4.72-0.1
libphp-adodb
Fixed versions: 4.72-0.1
libphp-adodb
Fixed versions: 4.72-0.1
Complete source record
{
"id": "671cbdec4cf5c74f12740af83523e155f0551a865b92f74de069d8c1b51bf3db",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2006-0146",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2006-0146",
"summary": "The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.",
"evidence": "osv:DEBIAN-CVE-2006-0146",
"products": [
{
"name": {
"value": "cacti",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.8.6d-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "cacti",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.8.6d-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "cacti",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "0.8.6d-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libphp-adodb",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.72-0.1",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libphp-adodb",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.72-0.1",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libphp-adodb",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.72-0.1",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2006-0146",
"aliases": [
"DEBIAN-CVE-2006-0146"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.6d-1"
}
]
}
],
"package": {
"name": "cacti",
"purl": "pkg:deb/debian/cacti?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-0146.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.6d-1"
}
]
}
],
"package": {
"name": "cacti",
"purl": "pkg:deb/debian/cacti?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-0146.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.6d-1"
}
]
}
],
"package": {
"name": "cacti",
"purl": "pkg:deb/debian/cacti?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-0146.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.72-0.1"
}
]
}
],
"package": {
"name": "libphp-adodb",
"purl": "pkg:deb/debian/libphp-adodb?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-0146.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.72-0.1"
}
]
}
],
"package": {
"name": "libphp-adodb",
"purl": "pkg:deb/debian/libphp-adodb?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-0146.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.72-0.1"
}
]
}
],
"package": {
"name": "libphp-adodb",
"purl": "pkg:deb/debian/libphp-adodb?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2006-0146.json"
},
"ecosystem_specific": {
"urgency": "medium"
}
}
],
"modified": "2026-10-22T23:47:25.553132307Z",
"provider": "osv",
"upstream": [
"CVE-2006-0146"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2006-0146"
]
},
"related_cves": [
{
"value": "CVE-2006-0146",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 410496,
"published_at": "2006-01-09T23:03:00+00:00"
}