PatchTheCVE: david bennetthttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2006-4881: Multiple cross-site scripting (XSS) vulnerabilities in David Bennett PHP-Post (PHPp) 1.0 and earlier allow remhttps://patchthecve.com/cve/CVE-2006-4881.htmlhttps://patchthecve.com/cve/CVE-2006-4881.htmlTue, 16 Jun 2026 22:29:57 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in David Bennett PHP-Post (PHPp) 1.0 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the replyuser parameter in (a) pm.php; (2) the txt_jumpto parameter in (b) dropdown.php; the (3) txt_error and (4) txt_templatenoCVE-2006-4880: David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to obtain sensitive information via a dihttps://patchthecve.com/cve/CVE-2006-4880.htmlhttps://patchthecve.com/cve/CVE-2006-4880.htmlTue, 16 Jun 2026 22:29:57 +0000MEDIUM 5.0: David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to obtain sensitive information via a direct request for (1) footer.php, (2) template.php, or (3) lastvisit.php, which reveals the installation path in various error messages.CVE-2006-4879: SQL injection vulnerability in profile.php in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attahttps://patchthecve.com/cve/CVE-2006-4879.htmlhttps://patchthecve.com/cve/CVE-2006-4879.htmlTue, 16 Jun 2026 22:29:57 +0000HIGH 7.5: SQL injection vulnerability in profile.php in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter.CVE-2006-4878: Directory traversal vulnerability in footer.php in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remotehttps://patchthecve.com/cve/CVE-2006-4878.htmlhttps://patchthecve.com/cve/CVE-2006-4878.htmlTue, 16 Jun 2026 22:29:57 +0000MEDIUM 5.0: Directory traversal vulnerability in footer.php in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to read and include arbitrary local files via a .. (dot dot) sequence in the template parameter. NOTE: this was later reported to affect 1.0.1, and demonstrated for code executioCVE-2006-4877: Variable overwrite vulnerability in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to ohttps://patchthecve.com/cve/CVE-2006-4877.htmlhttps://patchthecve.com/cve/CVE-2006-4877.htmlTue, 16 Jun 2026 22:29:57 +0000MEDIUM 5.0: Variable overwrite vulnerability in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to overwrite arbitrary program variables via multiple vectors that use the extract function, as demonstrated by the table_prefix parameter in (1) index.php, (2) profile.php, and (3) header.php.