How severe is CVE-2006-2690?

CVE-2006-2690 has a CVSS 2.0 base score of 7.8, rated high severity.

Is CVE-2006-2690 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (71st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2006-2690?

CVE-2006-2690 affects Eva-web. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2006-2690?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2006-2690 published?

CVE-2006-2690 was published on 2006-05-31 and last updated on 2026-06-16.

CVE-2006-2690

CVE-2006-2690 is a high-severity vulnerability in Eva-web with a CVSS 2.0 base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 2.0 base score 7.8)
EPSS exploit prediction: 1% (71st percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Eva-web
Published: 2006-05-31
Last modified: 2026-06-16

Description

An unspecified script in EVA-Web 2.1.2 and earlier, probably index.php, allows remote attackers to obtain the full path of the web server via invalid (1) perso or (2) aide parameters.

Frequently asked questions

What is CVE-2006-2690?: An unspecified script in EVA-Web 2.1.2 and earlier, probably index.php, allows remote attackers to obtain the full path of the web server via invalid (1) perso or (2) aide parameters.
How severe is CVE-2006-2690?: CVE-2006-2690 has a CVSS 2.0 base score of 7.8, rated high severity.
Is CVE-2006-2690 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (71st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2006-2690?: CVE-2006-2690 affects Eva-web. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2006-2690?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2006-2690 published?: CVE-2006-2690 was published on 2006-05-31 and last updated on 2026-06-16.

References

http://pridels0.blogspot.com/2006/05/eva-web-212-vuln.html

Affected products (1)

cpe:2.3:a:eva-web:eva-web:*:*:*:*:*:*:*:*

More vulnerabilities in Eva-web

CVE-2007-3460 — High (CVSS 7.5): Multiple PHP remote file inclusion vulnerabilities in index.php3 in EVA-Web 1.1 through 2.2 allow remote attackers to…
CVE-2006-2689 — Medium (CVSS 6.8): Multiple cross-site scripting (XSS) vulnerabilities in EVA-Web 2.1.2 and earlier allow remote attackers to inject…

All CVEs affecting Eva-web →