How severe is CVE-2006-2859?

CVE-2006-2859 has a CVSS 2.0 base score of 7.5, rated high severity.

Is CVE-2006-2859 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (76th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2006-2859?

CVE-2006-2859 affects Mywebland Mybloggie. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2006-2859?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2006-2859 published?

CVE-2006-2859 was published on 2006-06-06 and last updated on 2026-06-16.

CVE-2006-2859

CVE-2006-2859 is a high-severity vulnerability in Mywebland Mybloggie with a CVSS 2.0 base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 2.0 base score 7.5)
EPSS exploit prediction: 2% (76th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Mywebland Mybloggie
Published: 2006-06-06
Last modified: 2026-06-16

Description

PHP remote file inclusion vulnerability in MyBloggie 2.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mybloggie_root_path parameter to (1) admin.php or (2) scode.php. NOTE: this issue has been disputed in multiple third party followups, which say that the MyBloggie source code does not demonstrate the issue, so it might be the result of another module. CVE analysis as of 20060605 agrees with the dispute. In addition, scode.php is not part of the MyBloggie distribution

Frequently asked questions

What is CVE-2006-2859?: PHP remote file inclusion vulnerability in MyBloggie 2.1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mybloggie_root_path parameter to (1) admin.php or (2) scode.php. NOTE: this issue has been disputed in multiple third party followups, which say that the MyBloggie source code does not demonstrate the issue, so it might be the result of another module. CVE analysis as of 20060605 agrees with the dispute. In addition, scode.php is not part of the MyBloggie distribution
How severe is CVE-2006-2859?: CVE-2006-2859 has a CVSS 2.0 base score of 7.5, rated high severity.
Is CVE-2006-2859 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (76th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2006-2859?: CVE-2006-2859 affects Mywebland Mybloggie. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2006-2859?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2006-2859 published?: CVE-2006-2859 was published on 2006-06-06 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:mywebland:mybloggie:2.1.1:*:*:*:*:*:*:*

More vulnerabilities in Mywebland Mybloggie

CVE-2007-3194 — Critical (CVSS 9.8): Multiple PHP remote file inclusion vulnerabilities in myBloggie 2.1.5 allow remote attackers to execute arbitrary PHP…
CVE-2007-3003 — High (CVSS 7.5): Multiple SQL injection vulnerabilities in myBloggie 2.1.6 and earlier allow remote attackers to execute arbitrary SQL…
CVE-2006-4042 — High (CVSS 7.5): Multiple SQL injection vulnerabilities in trackback.php in myWebland myBloggie 2.1.4 and earlier allow remote attackers…
CVE-2006-3905 — High (CVSS 7.5): SQL injection vulnerability in Webland MyBloggie 2.1.3 allows remote attackers to execute arbitrary SQL commands via…
CVE-2005-4225 — High (CVSS 7.5): Multiple "potential" SQL injection vulnerabilities in myBloggie 2.1.3 beta might allow remote attackers to execute…
CVE-2005-3153 — High (CVSS 7.5): login.php in myBloggie 2.1.3 beta and earlier allows remote attackers to bypass a whitelist regular expression and…

All CVEs affecting Mywebland Mybloggie →