CVE-2006-1641: Czaries Network Czarnews

Medium severity, CVSS 5.1. EPSS: 2.4% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in CzarNews 1.14 allow remote attackers to execute arbitrary SQL commands via the (1) usern or (2) passw parameters to (a) cn_auth.php, (3) s parameter to (b) news.php, or (4) a parameter to (c) dpost.php.

Affected products

• Czaries Network Czarnews: up to and including 1.14; version 1.13b only

Published 2006-04-06. Last modified 2026-06-16.