{"cve":"CVE-2006-3016","nvd":{"published":"2006-06-14T23:02:00.000","modified":"2026-06-16T22:26:13.987","status":"Modified","description":"Unspecified vulnerability in session.c in PHP before 5.1.3 has unknown impact and attack vectors, related to \"certain characters in session names,\" including special characters that are frequently associated with CRLF injection, SQL injection, cross-site scripting (XSS), and HTTP response splitting vulnerabilities.  NOTE: while the nature of the vulnerability is unspecified, it is likely that this is related to a violation of an expectation by PHP applications that the session name is alphanumeric, as implied in the PHP manual for session_name().","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["ftp://patches.sgi.com/support/free/security/advisories/20061001-01-P.asc","http://rhn.redhat.com/errata/RHSA-2006-0736.html","http://secunia.com/advisories/19927","http://secunia.com/advisories/21050","http://secunia.com/advisories/22004"],"products":["php_group:php"],"source":"nvd","synced_at":"2026-10-19T19:42:44.451428143+00:00"},"epss":{"cve":"CVE-2006-3016","score":0.02545,"percentile":0.85009,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}