CVE-2006-6513

The CControl::Download function (/dl URI) in Winamp Web Interface (Wawi) 7.5.13 and earlier allows remote authenticated users to download arbitrary file types under the root via a trailing "." (dot) in a filename in the file parameter, related to erroneous behavior of the IsWinampFile function.

• http://aluigi.altervista.org/adv/wawix-adv.txtExploit
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051217.htmlExploit
• http://secunia.com/advisories/23292Exploit, Vendor Advisory
• http://securityreason.com/securityalert/2032
• http://securitytracker.com/id?1017362Exploit
• http://www.securityfocus.com/archive/1/454059/100/0/threaded
• http://www.securityfocus.com/bid/21539
• http://www.vupen.com/english/advisories/2006/4935
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30829
• http://aluigi.altervista.org/adv/wawix-adv.txtExploit
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051217.htmlExploit
• http://secunia.com/advisories/23292Exploit, Vendor Advisory
• http://securityreason.com/securityalert/2032
• http://securitytracker.com/id?1017362Exploit
• http://www.securityfocus.com/archive/1/454059/100/0/threaded
• http://www.securityfocus.com/bid/21539
• http://www.vupen.com/english/advisories/2006/4935
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30829

Published

Dec 14, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-6507Mozilla Firefox 2.0 before 2.0.0.1 allows remote attackers t…
• CVE-2006-6508Cross-site request forgery (CSRF) vulnerability in phpBB 2.0…
• CVE-2006-6509Cross-site scripting (XSS) vulnerability in the skinning fea…
• CVE-2006-6510An unspecified ActiveX control in SiteKiosk before 6.5.150 i…
• CVE-2006-6511dadaIMC .99.3 uses an insufficiently restrictive FilesMatch …
• CVE-2006-6512Directory traversal vulnerability in the Browse function (/b…
• CVE-2006-6514Winamp Web Interface (Wawi) 7.5.13 and earlier uses an insuf…
• CVE-2006-6515Mantis before 1.1.0a2 sets the default value of $g_bug_remin…
• CVE-2006-6516Multiple PHP remote file inclusion vulnerabilities in KDPics…
• CVE-2006-6517Multiple cross-site scripting (XSS) vulnerabilities in KDPic…
• CVE-2006-6518Multiple cross-site scripting (XSS) vulnerabilities in ProNe…
• CVE-2006-6519SQL injection vulnerability in lire-avis.php in ProNews 1.5 …