CVE-2006-3138: Accomplishtechnology Phpmydirectory

Medium severity, CVSS 4.3. EPSS: 2.1% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in phpMyDirectory 10.4.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PIC parameter in offers-pix.php, (2) from parameter in cp/index.php, and (3) action parameter in cp/admin_index.php.

Affected products

• Accomplishtechnology Phpmydirectory: up to and including 10.4.5; version 1.0 only; version 1.0.1 only; version 1.0.2 only; version 1.0.3 only; version 1.0.4 only; …

Published 2006-06-22. Last modified 2026-06-16.