Unrated severityNVD Advisory· Published Feb 13, 2006· Updated Jun 16, 2026

CVE-2006-0658

Description

Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Fckeditor/Fckeditor3 versions
cpe:2.3:a:fckeditor:fckeditor:2.0:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:fckeditor:fckeditor:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:fckeditor:fckeditor:2.2:*:*:*:*:*:*:*
- (no CPE)range: 2.0, 2.2

Patches

Vulnerability mechanics

References

retrogod.altervista.org/fckeditor_22_xpl.htmlnvdExploit
www.securityfocus.com/archive/1/424708nvdExploit
secunia.com/advisories/18767nvdVendor Advisory
www.vupen.com/english/advisories/2006/0502nvdVendor Advisory
www.exploit-db.com/exploits/3702nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.005
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000