CVE-2009-0711: Vlad Alexa Mancini Phpfootball

Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days.

filter.php in PHPFootball 1.6 and earlier allows remote attackers to retrieve password hashes via a request with an Accounts value for the dbtable parameter, in conjunction with a Password value for the dbfield parameter. NOTE: this has been reported as a SQL injection vulnerability by some sources, but the provenance of that information is unknown.

Affected products

• Vlad Alexa Mancini Phpfootball: version 1.5 only; version 1.6 only

Published 2009-02-23. Last modified 2026-06-16.