CVE-2006-6866: Stphp Easynews

High severity, CVSS 7.8. EPSS: 3.1% chance of exploitation in the next 30 days.

STphp EasyNews PRO 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, email addresses, and password hashes via a direct request for data/users.txt.

Affected products

• Stphp Easynews: version 4.0 only

Published 2006-12-31. Last modified 2026-06-16.