CVE-2006-1545: Vscripts Vnews

High severity, CVSS 9.0. EPSS: 3.4% chance of exploitation in the next 30 days.

Direct static code injection vulnerability in admin/config.php in vscripts (aka Kuba Kunkiewicz) VNews 1.2 allows remote authenticated administrators to execute code by inserting the code into variables that are stored in admin/config.php.

Affected products

• Vscripts Vnews: version 1.2 only

Published 2006-03-30. Last modified 2026-06-16.