Unrated severityNVD Advisory· Published Feb 13, 2006· Updated Apr 16, 2026

CVE-2006-0658

Description

Incomplete blacklist vulnerability in connector.php in FCKeditor 2.0 and 2.2, as used in products such as RunCMS, allows remote attackers to upload and execute arbitrary script files by giving the files specific extensions that are not listed in the Config[DeniedExtensions][File], such as .php.txt.

Affected products

Fckeditor/Fckeditor2 versions
cpe:2.3:a:fckeditor:fckeditor:2.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:fckeditor:fckeditor:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:fckeditor:fckeditor:2.2:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

retrogod.altervista.org/fckeditor_22_xpl.htmlnvdExploit
www.securityfocus.com/archive/1/424708nvdExploit
secunia.com/advisories/18767nvdVendor Advisory
www.vupen.com/english/advisories/2006/0502nvdVendor Advisory
www.exploit-db.com/exploits/3702nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.005
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000