How severe is CVE-2005-4226?

CVE-2005-4226 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2005-4226 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (87th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2005-4226?

CVE-2005-4226 affects Phpwebthings. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2005-4226?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2005-4226 published?

CVE-2005-4226 was published on 2005-12-14 and last updated on 2026-06-16.

CVE-2005-4226

CVE-2005-4226 is a high-severity vulnerability in Phpwebthings with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 2.0 base score 7.5)
EPSS exploit prediction: 3% (87th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Phpwebthings
Published: 2005-12-14
Last modified: 2026-06-16

Description

Multiple "potential" SQL injection vulnerabilities in phpWebThings 1.4 Patched might allow remote attackers to execute arbitrary SQL commands via (1) the ref parameter in download.php, (2) the direction, msg, sforum, reason, subname, and toform parameters in forum.php, (3) the msg and forum parameters in forum_edit.php, (4) the msg and forum parameters in forum_write.php, (5) the tekst parameter in guestbook.php, (6) the menuoption parameter in index.php, and the (7) sel_avatar parameter in myaccount.php. NOTE: the forum.php/forum vector is already identified by CVE-2005-3585.

Frequently asked questions

What is CVE-2005-4226?: Multiple "potential" SQL injection vulnerabilities in phpWebThings 1.4 Patched might allow remote attackers to execute arbitrary SQL commands via (1) the ref parameter in download.php, (2) the direction, msg, sforum, reason, subname, and toform parameters in forum.php, (3) the msg and forum parameters in forum_edit.php, (4) the msg and forum parameters in forum_write.php, (5) the tekst parameter in guestbook.php, (6) the menuoption parameter in index.php, and the (7) sel_avatar parameter in myaccount.php. NOTE: the forum.php/forum vector is already identified by CVE-2005-3585.
How severe is CVE-2005-4226?: CVE-2005-4226 has a CVSS 2.0 base score of 7.5, rated high severity.
Is CVE-2005-4226 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (87th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2005-4226?: CVE-2005-4226 affects Phpwebthings. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2005-4226?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2005-4226 published?: CVE-2005-4226 was published on 2005-12-14 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:phpwebthings:phpwebthings:*:*:*:*:*:*:*:*

More vulnerabilities in Phpwebthings

CVE-2009-2147 — High (CVSS 7.5): SQL injection vulnerability in fdown.php in phpWebThings 1.5.2 and earlier allows remote attackers to execute arbitrary…
CVE-2005-4218 — High (CVSS 7.5): SQL injection vulnerability in forum.php in PHPWebThings 1.4 allows remote attackers to execute arbitrary SQL commands…
CVE-2005-3676 — High (CVSS 7.5): SQL injection vulnerability in download.php in PhpWebThings 1.4.4 allows remote attackers to execute arbitrary SQL…
CVE-2005-3585 — High (CVSS 7.5): SQL injection vulnerability in forum.php in PhpWebThings 1.4.4 allows remote attackers to execute arbitrary SQL…
CVE-2007-3141 — Medium (CVSS 6.8): PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 allows remote attackers to execute…
CVE-2006-6042 — Medium (CVSS 6.8): PHP remote file inclusion vulnerability in core/editor.php in phpWebThings 1.5.2 and earlier, when register_globals is…

All CVEs affecting Phpwebthings →