CVE-2006-2532 json
stats.php in Destiney Rated Images Script 0.5.0 allows remote attackers to obtain the installation path via an invalid s parameter, which d…
published 2006-05-22 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-2532
- cvss
- 6.4
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
stats.php in Destiney Rated Images Script 0.5.0 allows remote attackers to obtain the installation path via an invalid s parameter, which displays the path in an error message. NOTE: this issue was originally claimed to be SQL injection, but CVE analysis shows that the problem is related to an invalid value that prevents some variables from being set.
Exploit prediction
1.14% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
References
-
securityfocus.com
/archive/1/434691/100/0/threaded
mailing-list
-
exchange.xforce.ibmcloud.com
/vulnerabilities/26603
vdb-entry
-
securityreason.com
/securityalert/940
third-party-advisory
Sources
- CVE List CVE-2006-2532
- NVD CVE-2006-2532
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.