$ cve CVE-2006-7052 JSON

CVE-2006-7052 EXPLOIT

10.0

HIGH · CVSS 2.0 · EPSS 6.4% (pctl 93)

Patch early

A public exploit exists.

Description

Multiple PHP remote file inclusion vulnerabilities in DotWidget For Articles (dotwidgeta) 0.2 allow remote attackers to execute arbitrary code via a URL in the (1) file_path parameter to (a) index.php, (b) showcatpicks.php, and (c) showarticle.php; and the (2) admin_header_file and (3) admin_footer_file parameters to (d) admin/authors.php, (e) admin/index.php, (f) admin/categories.php, (g) admin/editconfig.php, and (h) admin/articles.php.

Scoring

CVSS	10.0 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS	6.39% — more likely to be exploited than 93% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2007-02-24
Last modified	2026-06-16

Affected (1)

Vendor	Product
keith reichley	dotwidget for articles

Public exploits

Source	Title	Date
exploit-db	dotWidget for articles 2.0 - 'showcatpicks.php?file_path' Remote File Inclusion	2006-06-03
exploit-db	dotWidget for articles 2.0 - 'showarticle.php?file_path' Remote File Inclusion	2006-06-03
exploit-db	dotWidget for articles 2.0 - '/admin/authors.php' Multiple Remote File Inclusions	2006-06-03
exploit-db	dotWidget for articles 2.0 - '/admin/articles.php' Multiple Remote File Inclusions	2006-06-03
exploit-db	dotWidget for articles 2.0 - '/admin/index.php' Multiple Remote File Inclusions	2006-06-03
exploit-db	dotWidget for articles 2.0 - '/admin/categories.php' Multiple Remote File Inclusions	2006-06-03
exploit-db	dotWidget for articles 2.0 - '/admin/editconfig.php' Multiple Remote File Inclusions	2006-06-03

References

→ the Explorer · watch your stack · NVD