Webwiz develops a niche suite of web-based applications including forums, content-management, and news-distribution products that handle user input and dynamic content generation. The vendor's durable vulnerability signal centers on application-layer input-handling and authentication weaknesses—SQL injection, cross-site scripting, code injection, and improper authentication—that recur across its product line and reflect the web-application attack surface these tools present. Current severity and exploitation details are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Webwiz over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2006-6212HIGH PHP remote file inclusion vulnerability in centre.php in Site News (site_news) 2.00, and possibly earlier, allows remote attackers to execute arbitrary PHP code via a URL in the pa | Dec 1, 2006 | 7.5 | 28 | NO | YES |
CVE-2019-25442HIGH Web Wiz Forums 12.01 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the PF parameter. At | Feb 22, 2026 | 7.5 | 26 | NO | NO |
CVE-2009-5019MEDIUM Web Wiz NewsPad stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for data | Dec 1, 2010 | 5.0 | 26 | NO | YES |
CVE-2008-0473MEDIUM RTE_popup_save_file.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to upload (1) .html and (2) .htm files via unspecified vectors. | Jan 29, 2008 | 6.4 | 26 | NO | YES |
CVE-2008-0466MEDIUM Web Wiz RTE_file_browser.asp in, as used in Web Wiz Rich Text Editor 4.0, Web Wiz Forums 9.07, and Web Wiz Newspad 1.02, does not require authentication, which allows remote attack | Jan 29, 2008 | 5.0 | 24 | NO | YES |
CVE-2008-0479MEDIUM Directory traversal vulnerability in RTE_file_browser.asp in Web Wiz NewsPad 1.02 allows remote attackers to list arbitrary directories, and .txt and .zip files, via a .....\\\ in | Jan 29, 2008 | 5.0 | 23 | NO | YES |
CVE-2008-0480MEDIUM Multiple directory traversal vulnerabilities in Web Wiz Forums 9.07 and earlier allow remote attackers to list arbitrary directories, and .txt and .zip files, via a .....\\\ in the | Jan 29, 2008 | 5.0 | 23 | NO | YES |
CVE-2008-0481MEDIUM Directory traversal vulnerability in RTE_file_browser.asp in Web Wiz Rich Text Editor 4.0 allows remote attackers to list arbitrary directories, and .txt and .zip files, via a .... | Jan 29, 2008 | 5.0 | 23 | NO | YES |
CVE-2006-0175MEDIUM Cross-site scripting (XSS) vulnerability in search_form.asp in Web Wiz Forums 6.34 allows remote attackers to inject arbitrary web script or HTML via the search parameter. | Jan 11, 2006 | 4.3 | 22 | NO | YES |
CVE-2004-2733MEDIUM Web Wiz Forums 7.7a uses invalid logic to determine user privileges, which allows remote attackers to (1) block arbitrary IP addresses via pop_up_ip_blocking.asp or (2) modify topi | Dec 31, 2004 | 5.8 | 21 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Webwiz.
Media articles that mention a CVE ID that affects a product developed by Webwiz — matched by CVE ID, not by vendor name.