CVE-2000-0720 json
news.cgi in GWScripts News Publisher does not properly authenticate requests to add an author to the author index, which allows remote atta…
published 2000-10-20 26 y ago modified 2026-06-16 4 mo ago also EUVD-2000-0716
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 6.2%
- EPSS 6.2% chance of exploitation in 30 days, percentile 93%
- public exploits
- 1
- Exploit-DB
Summary
news.cgi in GWScripts News Publisher does not properly authenticate requests to add an author to the author index, which allows remote attackers to add new authors by directly posting an HTTP request to the new.cgi program with an addAuthor parameter, and setting the Referer to the news.cgi program.
Timeline
- First public exploit (EDB-20183)
- Published
Exploit prediction
6.16% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-20183 GWScripts News Publisher 1.0 - 'author.file' Write remote, 2000-08-29
- securityfocus.com http://www.securityfocus.com/bid/1621 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
References
-
securityfocus.com
/bid/1621
vdb-entry, exploit, vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/5169
vdb-entry
-
securityfocus.com
/templates/archive.pike?list=1&msg=003301c0123b%2418f8c1a0%24953b29d4%40e8s9s4
mailing-list
Sources
- CVE List CVE-2000-0720
- NVD CVE-2000-0720
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.