CVE-2006-6852 json
Eval injection vulnerability in tDiary 2.0.3 and 2.1.4.200 61127 allows remote authenticated users to execute arbitrary Ruby code via unspe…
published 2006-12-31 19 y ago modified 2026-06-16 4 mo ago also EUVD-2006-6835
- cvss
- 6.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
Eval injection vulnerability in tDiary 2.0.3 and 2.1.4.200 61127 allows remote authenticated users to execute arbitrary Ruby code via unspecified vectors, possibly related to incorrect input validation by (1) conf.rhtml and (2) i.conf.rhtml. NOTE: some of these details are obtained from third party information.
Patch / fix
- tdiary Debian 14, Debian 13, Debian 12 2.0.2+20060303-5
debian advisories DEBIAN-CVE-2006-6852
Exploit prediction
1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
secunia.com
/advisories/23465
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2006/5201
vdb-entry
-
jvn.jp
/jp/JVN%2331185550/index.html
third-party-advisory
-
securityfocus.com
/bid/21811
vdb-entry
- tdiary.org /20061210.html
Sources
- CVE List CVE-2006-6852
- NVD CVE-2006-6852
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.