CVE-2006-2878
published 2006-06-07CVE-2006-2878: The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly…
PriorityP346high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
14.04%
96.1th percentile
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by preg_replace with the /e (executable) modifier.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| andreas_gohr | dokuwiki | <= release_2006-06-04 | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
| andreas_gohr | dokuwiki | — | — |
CVSS provenance
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9h77-xrgv-4cw7: The spellchecker (spellcheck
ghsa_unreviewed·2022-05-01
CVE-2006-2878 [HIGH] GHSA-9h77-xrgv-4cw7: The spellchecker (spellcheck
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by preg_replace with the /e (executable) modifier.
OSV
CVE-2006-2878: The spellchecker (spellcheck
osv·2006-06-07·CVSS 7.5
CVE-2006-2878 [HIGH] CVE-2006-2878: The spellchecker (spellcheck
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by preg_replace with the /e (executable) modifier.
Debian
CVE-2006-2878: dokuwiki - The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remo...
vendor_debian·2006·CVSS 7.5
CVE-2006-2878 [HIGH] CVE-2006-2878: dokuwiki - The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remo...
The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" that is inserted into a regular expression that is processed by preg_replace with the /e (executable) modifier.
Scope: local
bookworm: resolved (fixed in 0.0.20060309-4)
bullseye: resolved (fixed in 0.0.20060309-4)
forky: resolved (fixed in 0.0.20060309-4)
sid: resolved (fixed in 0.0.20060309-4)
trixie: resolved (fixed in 0.0.20060309-4)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://bugs.splitbrain.org/index.php?do=details&id=823http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046602.htmlhttp://secunia.com/advisories/20429http://secunia.com/advisories/20669http://securitytracker.com/id?1016221http://www.gentoo.org/security/en/glsa/glsa-200606-16.xmlhttp://www.hardened-php.net/advisory_042006.119.htmlhttp://www.osvdb.org/25980http://www.securityfocus.com/archive/1/435989/100/0/threadedhttp://www.securityfocus.com/bid/18289http://www.vupen.com/english/advisories/2006/2142https://exchange.xforce.ibmcloud.com/vulnerabilities/26913http://bugs.splitbrain.org/index.php?do=details&id=823http://lists.grok.org.uk/pipermail/full-disclosure/2006-June/046602.htmlhttp://secunia.com/advisories/20429http://secunia.com/advisories/20669http://securitytracker.com/id?1016221http://www.gentoo.org/security/en/glsa/glsa-200606-16.xmlhttp://www.hardened-php.net/advisory_042006.119.htmlhttp://www.osvdb.org/25980http://www.securityfocus.com/archive/1/435989/100/0/threadedhttp://www.securityfocus.com/bid/18289http://www.vupen.com/english/advisories/2006/2142https://exchange.xforce.ibmcloud.com/vulnerabilities/26913
2006-06-07
Published