CVE-2006-1959 in the critical feed json
PHP remote file inclusion vulnerability in direct.php in ActualScripts ActualAnalyzer Lite 2.72 and earlier, Gold 7.63 and earlier, and Ser…
published 2006-04-21 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-1959
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 13.1%
- EPSS 13.1% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Exploit-DB
Summary
PHP remote file inclusion vulnerability in direct.php in ActualScripts ActualAnalyzer Lite 2.72 and earlier, Gold 7.63 and earlier, and Server 8.23 and earlier allows remote attackers to execute arbitrary code via a URL in the rf parameter.
Timeline
- Published
- First public exploit (EDB-1767)
Exploit prediction
13.05% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-1767 ActualAnalyzer Server 8.23 - 'rf' Remote File Inclusion webapps, 2006-05-08
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
exchange.xforce.ibmcloud.com
/vulnerabilities/25893
vdb-entry
-
secunia.com
/advisories/19743
third-party-advisory
-
securitytracker.com
/id?1015967
vdb-entry
-
vupen.com
/english/advisories/2006/1430
vdb-entry
-
securityreason.com
/securityalert/742
third-party-advisory
-
securityfocus.com
/bid/17597
vdb-entry
-
osvdb.org
/24778
vdb-entry
-
securityfocus.com
/archive/1/431351/100/0/threaded
mailing-list
-
securityfocus.com
/archive/1/434562/100/0/threaded
mailing-list
Sources
- CVE List CVE-2006-1959
- NVD CVE-2006-1959
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.