CVE-2006-1959 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 13.1% (pctl 96)
Patch early
A public exploit exists.
Description
PHP remote file inclusion vulnerability in direct.php in ActualScripts ActualAnalyzer Lite 2.72 and earlier, Gold 7.63 and earlier, and Server 8.23 and earlier allows remote attackers to execute arbitrary code via a URL in the rf parameter.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 13.09% — more likely to be exploited than 96% of all CVEs |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2006-04-21 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| actualscripts | actualanalyzer |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | ActualAnalyzer Server 8.23 - 'rf' Remote File Inclusion | 2006-05-08 |
References
- http://secunia.com/advisories/19743
- http://securityreason.com/securityalert/742
- http://securitytracker.com/id?1015967
- http://www.osvdb.org/24778
- http://www.securityfocus.com/archive/1/431351/100/0/threaded
- http://www.securityfocus.com/archive/1/434562/100/0/threaded
- http://www.securityfocus.com/bid/17597
- http://www.vupen.com/english/advisories/2006/1430
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25893
- http://secunia.com/advisories/19743
- http://securityreason.com/securityalert/742
- http://securitytracker.com/id?1015967
- http://www.osvdb.org/24778
- http://www.securityfocus.com/archive/1/431351/100/0/threaded
- http://www.securityfocus.com/archive/1/434562/100/0/threaded
- http://www.securityfocus.com/bid/17597
- http://www.vupen.com/english/advisories/2006/1430
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25893
→ the Explorer · watch your stack · NVD