CVE-2006-0636: Eyeos Project Eyeos

High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days.

desktop.php in eyeOS 0.8.9 and earlier tests for the existence of the _SESSION variable before calling the session_start function, which allows remote attackers to execute arbitrary PHP code and possibly conduct other attacks by modifying critical assumed-immutable variables, as demonstrated using PHP code in the _SESSION[apps][eyeOptions.eyeapp][wrapup] variable.

Affected products

• Eyeos Project Eyeos: version 0.8 only; version 0.8.1 only; version 0.8.1_r1 only; version 0.8.2 only; version 0.8.2_r1 only; version 0.8.2_r2 only; …

Published 2006-02-10. Last modified 2026-06-16.