PatchTheCVE: john limhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2011-3699: John Lim ADOdb Library for PHP 5.11 allows remote attackers to obtain sensitive information via a direct requehttps://patchthecve.com/cve/CVE-2011-3699.htmlhttps://patchthecve.com/cve/CVE-2011-3699.htmlTue, 16 Jun 2026 23:33:46 +0000MEDIUM 5.0: John Lim ADOdb Library for PHP 5.11 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by tests/test-active-record.php and certain other files.CVE-2006-4976: The Date Library in John Lim ADOdb Library for PHP allows remote attackers to obtain sensitive information viahttps://patchthecve.com/cve/CVE-2006-4976.htmlhttps://patchthecve.com/cve/CVE-2006-4976.htmlTue, 16 Jun 2026 22:30:14 +0000MEDIUM 5.0: The Date Library in John Lim ADOdb Library for PHP allows remote attackers to obtain sensitive information via a direct request for (1) server.php, (2) adodb-errorpear.inc.php, (3) adodb-iterator.inc.php, (4) adodb-pear.inc.php, (5) adodb-perf.inc.php, (6) adodb-xmlschema.inc.php, and (7) adodb.inc.CVE-2006-4618: PHP remote file inclusion vulnerability in adodb-postgres7.inc.php in John Lim ADOdb, possibly 4.01 and earliehttps://patchthecve.com/cve/CVE-2006-4618.htmlhttps://patchthecve.com/cve/CVE-2006-4618.htmlTue, 16 Jun 2026 22:29:27 +0000MEDIUM 5.1: PHP remote file inclusion vulnerability in adodb-postgres7.inc.php in John Lim ADOdb, possibly 4.01 and earlier, as used in Intechnic In-link 2.3.4, allows remote attackers to execute arbitrary PHP code via a URL in the ADODB_DIR parameter.CVE-2006-0806: Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESPhttps://patchthecve.com/cve/CVE-2006-0806.htmlhttps://patchthecve.com/cve/CVE-2006-0806.htmlTue, 16 Jun 2026 22:21:19 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via (1) the next_page parameter in adodb-pager.inc.php and (2) other unspecified vectors related to PHP_SELF.CVE-2006-0410: SQL injection vulnerability in ADOdb before 4.71, when using PostgreSQL, allows remote attackers to execute arhttps://patchthecve.com/cve/CVE-2006-0410.htmlhttps://patchthecve.com/cve/CVE-2006-0410.htmlTue, 16 Jun 2026 22:20:33 +0000MEDIUM 5.0: SQL injection vulnerability in ADOdb before 4.71, when using PostgreSQL, allows remote attackers to execute arbitrary SQL commands via unspecified attack vectors involving binary strings.CVE-2006-0147: Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used inhttps://patchthecve.com/cve/CVE-2006-0147.htmlhttps://patchthecve.com/cve/CVE-2006-0147.htmlTue, 16 Jun 2026 22:19:59 +0000HIGH 7.5: Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbCVE-2006-0146: The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2https://patchthecve.com/cve/CVE-2006-0146.htmlhttps://patchthecve.com/cve/CVE-2006-0146.htmlTue, 16 Jun 2026 22:19:59 +0000HIGH 7.5: The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL CVE-2004-2664: John Lim ADOdb Library for PHP before 4.23 allows remote attackers to obtain sensitive information via direct https://patchthecve.com/cve/CVE-2004-2664.htmlhttps://patchthecve.com/cve/CVE-2004-2664.htmlTue, 16 Jun 2026 22:10:05 +0000MEDIUM 5.0: John Lim ADOdb Library for PHP before 4.23 allows remote attackers to obtain sensitive information via direct requests to certain scripts that result in an undefined value of ADODB_DIR, which reveals the installation path in an error message.