CVE-2007-0620: Vlad Leont Fd Script

Medium severity, CVSS 5.0. EPSS: 3.6% chance of exploitation in the next 30 days.

download.php in FD Script 1.3.2 and earlier allows remote attackers to read source of files under the web document root with certain extensions, including .php, via a relative pathname in the fname parameter, as demonstrated by downloading config.php.

Affected products

• Vlad Leont Fd Script: version 1.3 only; version 1.3.1 only; version 1.3.2 only

Published 2007-01-31. Last modified 2026-06-16.