CVE-2006-6807 json
SQL injection vulnerability in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 and earlier allows remote attacker…
published 2006-12-28 19 y ago modified 2026-06-16 4 mo ago also EUVD-2006-6790
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 65%
- public exploits
- 2
- Exploit-DB
Summary
SQL injection vulnerability in list.asp in Softwebs Nepal (aka Ananda Raj Pandey) Ananda Real Estate 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the agent parameter.
Timeline
- First public exploit (EDB-3001)
- Published
Exploit prediction
1.10% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-15661 Ananda Real Estate 3.4 - 'list.asp' Multiple SQL Injections webapps, 2010-12-02
- EDB-3001 Ananda Real Estate 3.4 - 'agent' SQL Injection webapps, 2006-12-24
- securityfocus.com http://www.securityfocus.com/bid/21771 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
exploit-db.com
/exploits/3001
exploit
-
securityfocus.com
/bid/21771
vdb-entry, exploit
-
secunia.com
/advisories/23506
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2006/5179
vdb-entry
Sources
- CVE List CVE-2006-6807
- NVD CVE-2006-6807
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.