CVE-2006-0132 json
Directory traversal vulnerability in webftp.php in SysCP WebFTP 1.2.6 and possibly earlier allows remote attackers to include and execute a…
published 2006-01-09 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-0140
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 75%
- public exploits
- 0
- none known
Summary
Directory traversal vulnerability in webftp.php in SysCP WebFTP 1.2.6 and possibly earlier allows remote attackers to include and execute arbitrary local PHP scripts, and possibly read other types of files, via a .. (dot dot) and a trailing null in the webftp_language parameter.
Patch / fix
- secunia.com/advisories/18355 advisory
Exploit prediction
1.60% chance of exploitation in the next 30 days, higher than 75% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
References
-
secunia.com
/advisories/18355
third-party-advisory, patch, vendor-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/24018
vdb-entry
-
securityfocus.com
/archive/1/420973/100/0/threaded
mailing-list
-
securityfocus.com
/bid/16175
vdb-entry
-
vupen.com
/english/advisories/2006/0090
vdb-entry
Sources
- CVE List CVE-2006-0132
- NVD CVE-2006-0132
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.