CVE-2006-4768 json
Multiple direct static code injection vulnerabilities in add_go.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote attacker…
published 2006-09-13 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-4755
- cvss
- 5.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
Multiple direct static code injection vulnerabilities in add_go.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote attackers to execute arbitrary PHP code via the (1) description, (2) issue, (3) title, (4) var, (5) name, (6) keywords, and (7) note parameters, which are stored in an article file. NOTE: the original source of this vulnerability is unknown; the details are obtained from third party information and CVE post-disclosure analysis.
Exploit prediction
1.35% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
References
-
secunia.com
/advisories/21826
third-party-advisory, vendor-advisory
-
securityfocus.com
/bid/84155
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/28900
vdb-entry
-
osvdb.org
/28814
vdb-entry
-
vupen.com
/english/advisories/2006/3558
vdb-entry
Sources
- CVE List CVE-2006-4768
- NVD CVE-2006-4768
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.