SQL injection vulnerability in news.php in PHPNews 1.2.5 allows remote attackers to…
Priority LOW 35Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
SQL injection vulnerability in news.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the prevnext parameter.
Why it matters now
EPSS 0.01141 66th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2005-2156
- 2026-10-03 Alias added: GHSA-p6q5-pm5g-4fw5
More Phpnews vulnerabilities
- TI-2006-06823 Multiple PHP remote file inclusion vulnerabilities in PhpNews 1.0 allow remote attackers… CVSS 2.0HIGH 7.5
- TI-2005-02255 SQL injection vulnerability in auth.php in PHPNews 1.2.5 allows remote attackers to… CVSS 2.0HIGH 7.5
- TI-2004-02344 SQL injection vulnerability in PHPNews 1.2.3 allows remote attackers to execute arbitrary… CVSS 2.0HIGH 7.5
- TI-2006-06105 Multiple cross-site scripting (XSS) vulnerabilities in templates/link_temp.php in PHPNews… CVSS 2.0MEDIUM 6.8
- TI-2006-06106 Cross-site scripting (XSS) vulnerability in templates/cat_temp.php in PHPNews 1.3.0 and… CVSS 2.0MEDIUM 6.8
- TI-2005-00582 PHP remote file inclusion vulnerability in auth.php in PHPNews 1.2.4 and possibly 1.2.3… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2005-2156 · CVE Program
- CVE-2005-2156 · NVD
- FIRST EPSS
- GHSA-p6q5-pm5g-4fw5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences