CVE-2006-6786: Open Newsletter

Medium severity, CVSS 6.5. EPSS: 1.9% chance of exploitation in the next 30 days.

Open Newsletter 2.5 and earlier allows remote authenticated administrators to execute arbitrary PHP code by inserting the code into the email parameter to (1) subscribe.php or (2) unsubscribe.php.

Affected products

• Open Newsletter Open Newsletter: up to and including 2.5; version 2.0 only

Published 2006-12-28. Last modified 2026-06-16.