Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2006-6080: gNews Publisher categories.asp lets attackers run database commands

CVE-2006-6080 · published 19 years ago

Summary

The categories.asp page in gNews Publisher can be tricked into running harmful database queries when a user supplies specially crafted catID or editorID values. This could let an attacker view, change, or delete your data. Update to the latest version or apply the vendor's patch to sanitize those inputs.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
gazatem_technologies	gnews_publisher	All versions `cpe:2.3:a:gazatem_technologies:gnews_publisher::::::::`

Original advisory text

Multiple SQL injection vulnerabilities in categories.asp in gNews Publisher allow remote attackers to execute arbitrary SQL commands via the (1) catID or (2) editorID parameter.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

1% chance of attack within 30 days

Timeline

Published24 Nov 2006

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2006-6080 · NVD

Track software like this

Free during beta