P-News 2.0 stores db/user.txt under the web document root with insufficient access control, which allows remote attackers to obtain sensitive information such as usernames and password hashes via a direct request. NOTE: this might be the same issue as CVE-2006-6888.
Get an AI-powered plain-language explanation of this vulnerability and remediation steps.
Login to generate AI explanation6 reference(s) from NVD