Multiple SQL injection vulnerabilities in Image Gallery with Access Database allow remote attackers to execute arbitrary SQL commands via (…

published 2007-01-16 19 y ago modified 2026-06-16 4 mo ago also EUVD-2006-6915

cvss: 7.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.1%; EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits: 2; Exploit-DB

Multiple SQL injection vulnerabilities in Image Gallery with Access Database allow remote attackers to execute arbitrary SQL commands via (1) the id parameter to (a) dispimage.asp, or the (2) order or (3) page parameter to (b) default.asp.

Timeline

2006-11-16 First public exploit (EDB-29054)
2007-01-16 Published

Exploit prediction

1.07% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

EDB-29054 Image Gallery with Access Database - 'default.asp' Multiple SQL Injections webapps, 2006-11-16
EDB-29053 Image Gallery with Access Database - 'dispimage.asp?id' SQL Injection webapps, 2006-11-16

CVSS scores

assigned by	version	score	vector
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

References

securityreason.com /securityalert/2147
third-party-advisory
securityfocus.com /bid/21131
vdb-entry
securityfocus.com /archive/1/451875/100/0/threaded
mailing-list

Sources

CVE List CVE-2006-6932
NVD CVE-2006-6932

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary