CVE-2006-7049 json
The Method method in WikkaWiki (Wikka Wiki) before 1.1.6.2 calls the strstr and strrpos functions with the wrong argument order, which allo…
published 2007-02-24 19 y ago modified 2026-06-16 4 mo ago also EUVD-2006-7031
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known
Summary
The Method method in WikkaWiki (Wikka Wiki) before 1.1.6.2 calls the strstr and strrpos functions with the wrong argument order, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files.
Patch / fix
- securityfocus.com/bid/18484 patch
- osvdb.org/26543 patch
- secunia.com/advisories/20628 advisory
Exploit prediction
1.65% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
secunia.com
/advisories/20628
third-party-advisory, patch, vendor-advisory
-
securityfocus.com
/bid/18484
vdb-entry, patch
-
osvdb.org
/26543
vdb-entry, patch
-
exchange.xforce.ibmcloud.com
/vulnerabilities/27226
vdb-entry
- wikkawiki.org /WikkaReleaseNotes
-
vupen.com
/english/advisories/2006/2381
vdb-entry
Sources
- CVE List CVE-2006-7049
- NVD CVE-2006-7049
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.