CVE-2006-3772: PHP-Post

Medium severity, CVSS 5.1. EPSS: 16.8% chance of exploitation in the next 30 days.

PHP-Post 0.21 and 1.0, and possibly earlier versions, when auto-login is enabled, allows remote attackers to bypass security restrictions and obtain administrative privileges by modifying the logincookie[user] setting in the login cookie.

Affected products

• PHP-Post PHP-Post: version 0.21 only; version 1.0 only

Published 2006-07-24. Last modified 2026-06-16.