CVE-2006-5131 — module/shout/jafshout.php (aka the shoutbox) in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allows remote attackers to execute arbitrary code within sections bounded by "<?php" and "?>", possibly due to a static code injection vulnerability involving admin/data_inc.php

Back Back to CVE browser

HIGH

module/shout/jafshout.php (aka the shoutbox) in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allows remote attackers to execute arbitrary code within sections bounded by "<?php" and "?>", possibly due to a static code injection vulnerability involving admin/data_inc.php

Published Oct 2, 2006

7.5

HIGH

CVSS 2.0

EPSS 2.62%

Description

module/shout/jafshout.php (aka the shoutbox) in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allows remote attackers to execute arbitrary code within sections bounded by "<?php" and "?>", possibly due to a static code injection vulnerability involving admin/data_inc.php.

Affected products

Remediation

No remediation recorded yet.

Metrics

2.62% 0.02616

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.02616

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (11 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	2.62% (0.02616)	84.92th	v5 (v2026.06.15)
Jun 15, 2026	2.45% (0.02453)	82.23th	v5 (v2026.06.15)
Mar 30, 2025	1.73% (0.01733)	80.79th	v4 (v2025.03.14)
Mar 29, 2025	2.75% (0.02746)	76.63th	v4 (v2025.03.14)
Mar 17, 2025	1.73% (0.01733)	81.22th	v4 (v2025.03.14)
Dec 12, 2024	2.51% (0.02509)	90.52th	v3 (v2023.03.01)
Jun 29, 2023	2.51% (0.02509)	88.61th	v3 (v2023.03.01)
Mar 7, 2023	2.31% (0.02310)	87.96th	v3 (v2023.03.01)
Mar 6, 2023	6.52% (0.06523)	91.37th	v2 (v2022.01.01)
Apr 1, 2022	6.52% (0.06523)	90.53th	v2 (v2022.01.01)
Feb 4, 2022	6.52% (0.06523)	78.43th	v2 (v2022.01.01)

Weaknesses (0)

No CWE recorded.

References (3)

http://secunia.com/advisories/22143
third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://securityreason.com/securityalert/1674
third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/archive/1/447081/100/0/threaded
mailing-listx_refsource_BUGTRAQ

Link	Providers	Tags
http://secunia.com/advisories/22143		third-party-advisoryx_refsource_SECUNIAVendor Advisory
http://securityreason.com/securityalert/1674		third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/archive/1/447081/100/0/threaded		mailing-listx_refsource_BUGTRAQ

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Oct 2, 2006

Updated Aug 7, 2024

Reserved Oct 2, 2006

Link CVE-2006-5131

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2006-5131

Red Hat

Severity n/a

Public date n/a

Links CVE-2006-5131