CVE-2007-0261: Snews

High severity, CVSS 10.0. EPSS: 4.7% chance of exploitation in the next 30 days.

snews.php in sNews 1.5.30 and earlier does not properly exit when authentication fails, which allows remote attackers to perform unauthorized administrative actions, as demonstrated by changing an administrative password via the changeup task, and by uploading PHP code via the imagefile parameter.

Affected products

• Snews Snews: version 1.5.29 only; version 1.5.30 only

Published 2007-01-16. Last modified 2026-06-16.