CVE-2006-6866

CVE-2006-6866 describes a critical information disclosure vulnerability in STphp EasyNews PRO 4.0, where sensitive user data, including usernames, email addresses, and password hashes, is stored in an unprotected file (data/users.txt) accessible via direct web request. With a CVSS score of 7.8, this vulnerability allows unauthenticated remote attackers to easily obtain this information due to insufficient access control. While not listed on CISA's KEV catalog, an exploit (EDB-3039) is publicly available on ExploitDB, indicating a clear path for exploitation, though there is no evidence of active exploitation or significant community discussion.