PHP remote file inclusion vulnerability in headlines.php in Fantastic News 2.1.4 and possibly earlier allows remote attackers to execute arbitrary PHP code via a URL in the CONFIGscript_path parameter a different vector than CVE-2006-1154.