« Back to list

CVE-2006-1823

Status: ModifiedMedium (6.4)—

Directory traversal vulnerability in FarsiNews 2.5.3 Pro and earlier allows remote attackers to obtain the installation path via ".." sequences in the archive parameter to index.php, which leaks the full pathname in an error message.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Farsinews — Farsinews

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2006-1823",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-04-18T10:02:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/19648",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/710",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1015943",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/431011/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/1411",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/19648",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/710",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1015943",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/431011/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/1411",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory traversal vulnerability in FarsiNews 2.5.3 Pro and earlier allows remote attackers to obtain the installation path via \"..\" sequences in the archive parameter to index.php, which leaks the full pathname in an error message."
    }
  ],
  "lastModified": "2026-06-16T22:23:45.083",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:farsinews:farsinews:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCB2CEC8-7EFF-410F-A4E2-CDC515F9E38E"
            },
            {
              "criteria": "cpe:2.3:a:farsinews:farsinews:2.1_beta2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F6F8CFD-D03F-494E-96E0-A8C9CCDC6355"
            },
            {
              "criteria": "cpe:2.3:a:farsinews:farsinews:2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA3F0B6F-F519-4717-B1A4-5CE599DB611F"
            },
            {
              "criteria": "cpe:2.3:a:farsinews:farsinews:2.5.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB1005EB-A6C0-4601-8193-ABB130B30E45"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}