CVE-2006-6033: Sphpblog

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Multiple directory traversal vulnerabilities in Simple PHP Blog (SPHPBlog), probably 0.4.8, allow remote attackers to read arbitrary files and possibly include arbitrary PHP code via a .. (dot dot) sequence in the blog_theme parameter in (1) index.php, (2) add_cgi.php, (3) add_link.php, (4) login.php, (5) template.php, or (6) contact.php.

Affected products

• Sphpblog Sphpblog: version 0.4.8 only

Published 2006-11-21. Last modified 2026-06-16.