← Vulnerability feed

Vulnerability record · CVE-2006-2522 · published 22 May 2006

CVE-2006-2522: Dayfox designs dayfox blog vulnerability

DDayfox Designs · Dayfox Blog

Dayfox Blog 2.0 and earlier stores user credentials in edit/slog_users.txt under the web document root with insufficient access control, which allows remote attackers to gain privileges.

7.5 CVSS 2.0 High EPSS 1.9% · top 21.7%
7.5CVSS 2.0 base score
1.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

Dayfox Blog 2.0 and earlier stores user credentials in edit/slog_users.txt under the web document root with insufficient access control, which allows remote attackers to gain privileges.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://colander.altervista.org/advisory/DayfoxBlog.txt ExploitVendor Advisory
http://secunia.com/advisories/20216 Vendor Advisory
http://securitytracker.com/id?1016163
http://www.osvdb.org/25689
http://www.vupen.com/english/advisories/2006/1904
https://exchange.xforce.ibmcloud.com/vulnerabilities/26623
http://colander.altervista.org/advisory/DayfoxBlog.txt ExploitVendor Advisory
http://secunia.com/advisories/20216 Vendor Advisory
http://securitytracker.com/id?1016163
http://www.osvdb.org/25689
http://www.vupen.com/english/advisories/2006/1904
https://exchange.xforce.ibmcloud.com/vulnerabilities/26623

Track CVE-2006-2522 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2008-3564Dayfox designs dayfox blog path traversal vulnerabilityMultiple directory traversal vulnerabilities in index.php in Dayfox Blog 4 allow remote attackers to include and execute arbitrary local files via a …EPSS 2.5%7.5CVE-2007-0150Dayfox designs dayfox blog vulnerabilityMultiple PHP remote file inclusion vulnerabilities in index.php in Dayfox Blog allow remote attackers to execute arbitrary PHP code via a URL in the …EPSS 1.8%7.5CVE-2006-5183Dayfox designs dayfox blog vulnerabilityMultiple PHP remote file inclusion vulnerabilities in Dayfox Designs Dayfox Blog 2.0 allow remote attackers to execute arbitrary PHP code via a URL i…EPSS 1.5%6.8CVE-2007-1525Dayfox designs dayfox blog vulnerabilityDirect static code injection vulnerability in postpost.php in Dayfox Blog (dfblog) 4 allows remote attackers to execute arbitrary PHP code via the ca…EPSS 37%

Source: NIST National Vulnerability Database (record CVE-2006-2522), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.