CVE-2006-3194

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-06-23 · updated 2026-06-16

Description

Directory traversal vulnerability in index.php in singapore 0.10.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) sequence and trailing null (%00) byte in the (1) gallery and (2) template parameter.

Affected products

Singapore: 0.9.1_beta, 0.9.2_beta, 0.9.3_beta, 0.9.4_beta, 0.9.5_beta, 0.9.6_beta (+11)

References

http://secunia.com/advisories/20724
http://securityreason.com/securityalert/1135
http://www.securityfocus.com/archive/1/437716/100/0/threaded
http://www.securityfocus.com/bid/18518
http://www.vupen.com/english/advisories/2006/2457
https://exchange.xforce.ibmcloud.com/vulnerabilities/27325
http://secunia.com/advisories/20724
http://securityreason.com/securityalert/1135
http://www.securityfocus.com/archive/1/437716/100/0/threaded
http://www.securityfocus.com/bid/18518
http://www.vupen.com/english/advisories/2006/2457
https://exchange.xforce.ibmcloud.com/vulnerabilities/27325

Get alerted when CVE-2006-3194 or the next vulnerability affects your stack