Skip to content
Fencer Vulns
medium 4.0

CVE-2006-0787 json

wimpy_trackplays.php in Plaino Wimpy MP3 Player, possibly 5.2 and earlier, allows remote attackers to insert arbitrary strings into trackme…

published 2006-02-19 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-0793

cvss
4.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.2%
EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits
1
Exploit-DB

Summary

wimpy_trackplays.php in Plaino Wimpy MP3 Player, possibly 5.2 and earlier, allows remote attackers to insert arbitrary strings into trackme.txt via the (1) trackFile, (2) trackArtist, and (3) trackTitle parameters, which can result in providing false information about songs, occupying excessive disk space with very long parameter values, and storing executable code that might be invoked through a different vulnerability. NOTE: since this issue, as described by the original researcher, is entirely dependent on the presence of another vulnerability, it could be argued that Wimpy cannot be responsible for how its data file is processed by applications outside of its control. Since this issue might only be useful as a facilitator manipulation in another vulnerability, perhaps it should not be included in CVE.

Timeline

  1. First public exploit (EDB-27244)
  2. Published

Exploit prediction

2.22% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-27244 Wimpy MP3 Player 5 - Text File Overwrite remote, 2006-02-16
  • securityfocus.com http://www.securityfocus.com/bid/16696 referenced PoC, tagged "exploit" by a source, unverified
  • xorcrew.net http://www.xorcrew.net/xpa/XPA-WimpyMP3Player.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 4.0 AV:N/AC:H/Au:N/C:N/I:P/A:P

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.