How severe is CVE-2006-4768?

CVE-2006-4768 has a CVSS 2.0 base score of 5.0, rated medium severity.

Is CVE-2006-4768 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (67th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2006-4768?

CVE-2006-4768 affects Stefan Ernst Newsscript. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2006-4768?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2006-4768 published?

CVE-2006-4768 was published on 2006-09-13 and last updated on 2026-06-16.

CVE-2006-4768

CVE-2006-4768 is a medium-severity vulnerability in Stefan Ernst Newsscript with a CVSS 2.0 base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 5.0)
EPSS exploit prediction: 1% (67th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Stefan Ernst Newsscript
Published: 2006-09-13
Last modified: 2026-06-16

Description

Multiple direct static code injection vulnerabilities in add_go.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote attackers to execute arbitrary PHP code via the (1) description, (2) issue, (3) title, (4) var, (5) name, (6) keywords, and (7) note parameters, which are stored in an article file. NOTE: the original source of this vulnerability is unknown; the details are obtained from third party information and CVE post-disclosure analysis.

Frequently asked questions

What is CVE-2006-4768?: Multiple direct static code injection vulnerabilities in add_go.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote attackers to execute arbitrary PHP code via the (1) description, (2) issue, (3) title, (4) var, (5) name, (6) keywords, and (7) note parameters, which are stored in an article file. NOTE: the original source of this vulnerability is unknown; the details are obtained from third party information and CVE post-disclosure analysis.
How severe is CVE-2006-4768?: CVE-2006-4768 has a CVSS 2.0 base score of 5.0, rated medium severity.
Is CVE-2006-4768 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (67th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2006-4768?: CVE-2006-4768 affects Stefan Ernst Newsscript. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2006-4768?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2006-4768 published?: CVE-2006-4768 was published on 2006-09-13 and last updated on 2026-06-16.

References

Affected products (1)

cpe:2.3:a:stefan_ernst:newsscript:0.5_beta:*:*:*:*:*:*:*

More vulnerabilities in Stefan Ernst Newsscript

CVE-2006-4666 — High (CVSS 7.5): Multiple PHP remote file inclusion vulnerabilities in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allow remote…
CVE-2006-4767 — Medium (CVSS 6.4): Multiple directory traversal vulnerabilities in Stefan Ernst Newsscript (aka WM-News) 0.5beta allow remote attackers to…
CVE-2006-4766 — Medium (CVSS 5.0): Directory traversal vulnerability in print.php in Stefan Ernst Newsscript (aka WM-News) 0.5 beta allows remote…

All CVEs affecting Stefan Ernst Newsscript →