CVE-2006-0660

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-02-13 · updated 2026-06-16

Description

Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to (1) read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or (2) include arbitrary files via the template parameter to show_archives.php.

Affected products

Farsinews: 2.1, 2.1_beta2, 2.5

References

http://forum.farsinewsteam.com/index.php?showtopic=71
http://forum.farsinewsteam.com/index.php?showtopic=76
http://secunia.com/advisories/18768
http://www.hamid.ir/security/farsinews2-5.txt
http://www.osvdb.org/23020
http://www.osvdb.org/23021
http://www.osvdb.org/23022
http://www.securityfocus.com/archive/1/424720/100/0/threaded
http://www.securityfocus.com/bid/16580
http://www.vupen.com/english/advisories/2006/0506
https://exchange.xforce.ibmcloud.com/vulnerabilities/24598
https://exchange.xforce.ibmcloud.com/vulnerabilities/24602

Get alerted when CVE-2006-0660 or the next vulnerability affects your stack