CVE-2006-0315: index.php in EZDatabase before 2.1.2 does not properly cleanse the p parameter before constructing and incl...

Security readout for executives and security teams

EZDatabase before 2.1.2 let a request parameter influence which PHP file was included. That could expose server file paths and create XSS behavior. The source bundle does not show active exploitation, CVSS scoring, or broad product metadata, so urgency depends on whether the legacy application is still deployed. Exposure is limited to EZDatabase installations before 2.1.2 where index.php is reachable and the p parameter is accepted. The bundle lists vendor and CPE data as unavailable, so teams need application inventory or code/version inspection to confirm impact. Prioritize if EZDatabase is internet-facing or business-critical. Otherwise, handle through legacy application cleanup. The main risk is information exposure and browser-side compromise, with no source-backed evidence of active exploitation in the bundle. Mitigation focus: Upgrade EZDatabase to version 2.1.2 or later if still supported.; Remove or isolate legacy EZDatabase deployments that cannot be updated.; Restrict public access to affected index.php routes where business use is unnecessary..

Prepared

Jun 29, 2026, 15:05 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.