How severe is CVE-2006-1289?

CVE-2006-1289 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2006-1289 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2006-1289?

CVE-2006-1289 primarily affects Milkeyway Milkeyway Captive Portal. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2006-1289?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2006-1289 published?

CVE-2006-1289 was published on 2006-03-19 and last updated on 2026-06-16.

CVE-2006-1289

CVE-2006-1289 is a high-severity vulnerability in Milkeyway Milkeyway Captive Portal with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 2.0 base score 7.5)
EPSS exploit prediction: 2% (80th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Milkeyway Milkeyway Captive Portal
Published: 2006-03-19
Last modified: 2026-06-16

Description

Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) password, (3) team, (4) level, (5) status, (6) teamname, and (7) teamlead parameters in (a) auth.php; the (8) username, (9) action, and (10) filter parameters in (b) authuser.php; the (11) username parameter in (c) utils.php; the (12) id and (13) date parameters in (d) traffic.php; the (14) username parameter in (e) userstatistics.php; and the (15) USERNAME and (16) PASSWORD parameters in a cookie to (f) chgpwd.php.

Frequently asked questions

What is CVE-2006-1289?: Multiple SQL injection vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) password, (3) team, (4) level, (5) status, (6) teamname, and (7) teamlead parameters in (a) auth.php; the (8) username, (9) action, and (10) filter parameters in (b) authuser.php; the (11) username parameter in (c) utils.php; the (12) id and (13) date parameters in (d) traffic.php; the (14) username parameter in (e) userstatistics.php; and the (15) USERNAME and (16) PASSWORD parameters in a cookie to (f) chgpwd.php.
How severe is CVE-2006-1289?: CVE-2006-1289 has a CVSS 2.0 base score of 7.5, rated high severity.
Is CVE-2006-1289 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2006-1289?: CVE-2006-1289 primarily affects Milkeyway Milkeyway Captive Portal. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2006-1289?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2006-1289 published?: CVE-2006-1289 was published on 2006-03-19 and last updated on 2026-06-16.

References

Affected products (2)

cpe:2.3:a:milkeyway:milkeyway_captive_portal:0.1:*:*:*:*:*:*:*
cpe:2.3:a:milkeyway:milkeyway_captive_portal:0.1.1:*:*:*:*:*:*:*

More vulnerabilities in Milkeyway Milkeyway Captive Portal

CVE-2006-1290 — Medium (CVSS 4.3): Multiple cross-site scripting (XSS) vulnerabilities in Milkeyway Captive Portal 0.1 and 0.1.1 allow remote attackers to…

All CVEs affecting Milkeyway Milkeyway Captive Portal →