Fscripts Fantastic News vulnerabilities
5 known vulnerabilities affecting fscripts/fantastic_news.
Total CVEs
5
CISA KEV
0
Public exploits
4
Exploited in wild
0
Severity breakdown
HIGH3MEDIUM2
Vulnerabilities
Page 1 of 1
CVE-2006-4285P3HIGHCVSS 7.5PoCv2.1.1v2.1.2+2 more2006-08-22
CVE-2006-4285 [HIGH] CWE-94 CVE-2006-4285: PHP remote file inclusion vulnerability in news.php in Fantastic News 2.1.3 and earlier allows remot
PHP remote file inclusion vulnerability in news.php in Fantastic News 2.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[script_path] parameter. NOTE: it was later reported that 2.1.5 is also affected.
nvd
CVE-2005-3846P3HIGHCVSS 7.5PoC≤ 2.1.12005-11-26
CVE-2005-3846 [HIGH] CVE-2005-3846: SQL injection vulnerability in news.php in Fantastic News 2.1.1 and earlier allows remote attackers
SQL injection vulnerability in news.php in Fantastic News 2.1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the category parameter.
nvd
CVE-2006-4671P3MEDIUMCVSS 6.8PoC≤ 2.1.4v2.1.1+2 more2006-09-11
CVE-2006-4671 [MEDIUM] CVE-2006-4671: PHP remote file inclusion vulnerability in headlines.php in Fantastic News 2.1.4, and possibly earli
PHP remote file inclusion vulnerability in headlines.php in Fantastic News 2.1.4, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the CONFIG[script_path] parameter, a different vector than CVE-2006-1154.
nvd
CVE-2006-0972P4MEDIUMCVSS 5.0PoCv2.1.12006-03-03
CVE-2006-0972 [MEDIUM] CVE-2006-0972: SQL injection vulnerability in news.php in Tony Baird Fantastic News 2.1.1 allows remote attackers t
SQL injection vulnerability in news.php in Tony Baird Fantastic News 2.1.1 allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the category vector is already covered by CVE-2005-3846.
nvd
CVE-2006-1154P4HIGHCVSS 7.5v2.1.1v2.1.2+1 more2006-03-10
CVE-2006-1154 [HIGH] CWE-94 CVE-2006-1154: PHP remote file inclusion vulnerability in archive.php in Fantastic News 2.1.2 allows remote attacke
PHP remote file inclusion vulnerability in archive.php in Fantastic News 2.1.2 allows remote attackers to include arbitrary files via the CONFIG[script_path] variable. NOTE: 2.1.4 was also reported to be vulnerable.
nvd