CVE-2006-3860 json
IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 before 10.00.xC3 allows allows remote authenticated users to execute arbitrary…
published 2006-08-17 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-3854
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.1%
- EPSS 3.1% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 before 10.00.xC3 allows allows remote authenticated users to execute arbitrary commands via the (1) "SET DEBUG FILE" SQL command, and the (2) start_onpload and (3) dbexp functions.
Exploit prediction
3.07% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
secunia.com
/advisories/21301
third-party-advisory, vendor-advisory
-
osvdb.org
/27686
vdb-entry
- www-1.ibm.com /support/docview.wss?uid=swg21242921
-
exchange.xforce.ibmcloud.com
/vulnerabilities/28121
vdb-entry
-
securityreason.com
/securityalert/1407
third-party-advisory
-
securityfocus.com
/archive/1/443133/100/0/threaded
mailing-list
- databasesecurity.com /informix/DatabaseHackersHandbook-AttackingInformix.pdf
-
exchange.xforce.ibmcloud.com
/vulnerabilities/28124
vdb-entry
-
securityfocus.com
/bid/19264
vdb-entry
-
securityfocus.com
/archive/1/443185/100/0/threaded
mailing-list
-
vupen.com
/english/advisories/2006/3077
vdb-entry
Sources
- CVE List CVE-2006-3860
- NVD CVE-2006-3860
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.