CVE-2006-3685: Czaries Network Czarnews

Medium severity, CVSS 5.1. EPSS: 2.8% chance of exploitation in the next 30 days.

PHP remote file inclusion vulnerability in CzarNews 1.12 through 1.14 allows remote attackers to execute arbitrary PHP code via a URL in the tpath parameter to cn_config.php. NOTE: the news.php vector is already covered by CVE-2005-0859.

Affected products

• Czaries Network Czarnews: version 1.12 only; version 1.13 only; version 1.14 only

Published 2006-07-21. Last modified 2026-06-16.