$ cve CVE-2008-0466 JSON

CVE-2008-0466 EXPLOIT

5.0

MEDIUM · CVSS 2.0 · EPSS 4.9% (pctl 92)

Patch early

A public exploit exists.

Description

Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attackers to list directories and read files. NOTE: this can be leveraged for listings outside the configured directory tree by exploiting a separate directory traversal vulnerability.

Scoring

CVSS	5.0 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:N/A:N
EPSS	4.93% — more likely to be exploited than 92% of all CVEs
Weakness	CWE-287
On CISA KEV	no
Public exploit	yes
Published	2008-01-29
Last modified	2026-06-16

Affected (3)

Vendor	Product
webwiz	web wiz forums
webwiz	web wiz newspad
webwiz	web wiz rich text editor

Public exploits

Source	Title	Date
exploit-db	Web Wiz Forums 9.07 - 'sub' Directory Traversal	2008-01-23
exploit-db	Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities	2008-01-23

References

→ the Explorer · watch your stack · NVD