CVE-2006-4768

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-09-13 · updated 2026-06-16

Description

Multiple direct static code injection vulnerabilities in add_go.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote attackers to execute arbitrary PHP code via the (1) description, (2) issue, (3) title, (4) var, (5) name, (6) keywords, and (7) note parameters, which are stored in an article file. NOTE: the original source of this vulnerability is unknown; the details are obtained from third party information and CVE post-disclosure analysis.

Affected products

Stefan Ernst Newsscript: 0.5_beta

References

http://secunia.com/advisories/21826
http://www.osvdb.org/28814
http://www.securityfocus.com/bid/84155
http://www.vupen.com/english/advisories/2006/3558
https://exchange.xforce.ibmcloud.com/vulnerabilities/28900
http://secunia.com/advisories/21826
http://www.osvdb.org/28814
http://www.securityfocus.com/bid/84155
http://www.vupen.com/english/advisories/2006/3558
https://exchange.xforce.ibmcloud.com/vulnerabilities/28900

Get alerted when CVE-2006-4768 or the next vulnerability affects your stack