CVE-2006-0660
Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers...
Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to (1) read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or (2) include arbitrary files via the template parameter to show_archives.php.
Exploit likelihood
What each source reports
NVD Score used
Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to (1) read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or (2) include arbitrary files via the template parameter to show_archives.php.
- Record
CVE-2006-0660- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to (1) read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or (2) include arbitrary files via the template parameter to show_archives.php.
- Record
CVE-2006-0660- Updated
- 2026-11-02
EUVDEUVD-2006-0667 No score
Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to (1) read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or (2) include arbitrary files via the template parameter to show_archives.php.
- Record
EUVD-2006-0667- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6wcr-6gpx-r6g2 No score
Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers...
Multiple directory traversal vulnerabilities in FarsiNews 2.5 and earlier allows remote attackers to (1) read arbitrary files or trigger an error message path disclosure via ".." or invalid names in the archive parameter to index.php, or (2) include arbitrary files via the template parameter to show_archives.php.
- Record
GHSA-6wcr-6gpx-r6g2- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Farsinews 2.5 - Directory Traversal Arbitrary 'users.db' Access | 2006-02-28 |
| Exploit-DB | Farsinews 2.1/2.5 - 'show_archives.php?template' Traversal Arbitrary File Access | 2006-02-10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-0660 is a medium vulnerability (CVSS 6.4) in Farsinews, published February 13, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.73%, the 91st percentile. No source names a fixed version.