CVE-2006-2326: Directory traversal vulnerability in index.php in OnlyScript.info Online Universal Payment System Script al...

Security readout for executives and security teams

This CVE describes a possible arbitrary file-read issue in an old PHP payment script. A remote attacker may be able to access files the web server can read. The record warns that provenance is unknown and details come only from third-party information, so urgency depends on whether this obsolete product exists in your environment. Exposure is limited to organizations still running the named OnlyScript.info payment script or reused code derived from it. Public internet-facing PHP deployments are the main concern. The source bundle does not identify specific versions, package names, CPEs, or supported platforms. Prioritize as an exposure-discovery item, not a confirmed emergency, unless the product is found on a public payment site. If present, the business risk is sensitive file disclosure from a payment-adjacent web application, with limited public evidence about versions or fixes. Mitigation focus: Inventory public PHP sites for the named OnlyScript.info payment script.; Check vendor or archived advisory guidance for a fixed release or official workaround.; Remove or isolate unsupported instances until exposure is understood..

Prepared

Jun 29, 2026, 12:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.