CVE-2006-5086: Pixel Motion Blog

Medium severity, CVSS 6.4. EPSS: 1.2% chance of exploitation in the next 30 days.

Blog Pixel Motion 2.1.1 allows remote attackers to change the username and password for the admin user via a direct request to insere_base.php with modified (1) login and (2) pass parameters. NOTE: this issue was claimed to be SQL injection by the original researcher, but it is not.

Affected products

• Pixel Motion Pixel Motion Blog: version 2.1.1 only

Published 2006-09-29. Last modified 2026-06-16.