CVE-2006-4656 in the critical feed json
PHP remote file inclusion vulnerability in admin/editeur/spaw_control.class.php in Web Provence SL_Site 1.0 and earlier allows remote attac…
published 2006-09-09 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-4644
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 11.1%
- EPSS 11.1% chance of exploitation in 30 days, percentile 95%
- public exploits
- 2
- Exploit-DB
Summary
PHP remote file inclusion vulnerability in admin/editeur/spaw_control.class.php in Web Provence SL_Site 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the spaw_root parameter. NOTE: CVE analysis suggests that this issue is actually in a third party product, SPAW Editor PHP Edition.
Timeline
- First public exploit (EDB-2317)
- Published
Exploit prediction
11.14% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
exploit-db.com
/exploits/2317
exploit
-
exchange.xforce.ibmcloud.com
/vulnerabilities/28783
vdb-entry
-
securityfocus.com
/archive/1/445520/100/0/threaded
mailing-list
- spaw.cvs.sourceforge.net /spaw/spaw/spaw_control.class.php?r1=1.19&r2=1.20
-
securityreason.com
/securityalert/1522
third-party-advisory
-
securityfocus.com
/bid/19892
vdb-entry
- spaw.cvs.sourceforge.net /spaw/spaw/spaw_control.class.php?r1=1.25&r2=1.26
- spaw.cvs.sourceforge.net /spaw/spaw/docs/ChangeLog.txt?view=markup
-
securitytracker.com
/id?1016814
vdb-entry
Sources
- CVE List CVE-2006-4656
- NVD CVE-2006-4656
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.