CVE-2006-1888: Phpgraphy

Medium severity, CVSS 6.8. EPSS: 2.2% chance of exploitation in the next 30 days.

phpGraphy 0.9.11 and earlier allows remote attackers to bypass authentication and gain administrator privileges via a direct request to index.php with the editwelcome parameter set to 1, which can then be used to modify the main page to inject arbitrary HTML and web script. NOTE: XSS attacks are resultant from this issue, since normal functionality allows the admin to modify pages.

Affected products

• Phpgraphy Phpgraphy: up to and including 0.9.11; version 0.9.9a only; version 0.9.10 only

Published 2006-04-20. Last modified 2026-06-16.