CVE-2006-4065
Multiple PHP remote file inclusion vulnerabilities in Dmitry Sheiko SAPID Gallery 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) root_path parameter to (a) usr/extensions/get_calendar.inc.php or the (2)…
Does this matter?
Lower severity and a low EPSS score (2.42%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple PHP remote file inclusion vulnerabilities in Dmitry Sheiko SAPID Gallery 1.0 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) root_path parameter to (a) usr/extensions/get_calendar.inc.php or the (2) GLOBALS[root_path] parameter to (b) usr/extensions/get_tree.inc.php.
- CVSS 2.0
- 5.1 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
- EPSS
- 2.42% probability · 83th percentile
- CISA KEV
- Not listed
- Affected
- dmitry sheiko/sapid gallery
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/21413Exploit, Vendor Advisory
- http://www.vupen.com/english/advisories/2006/3197
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28254
- https://www.exploit-db.com/exploits/2130
- http://secunia.com/advisories/21413Exploit, Vendor Advisory
- http://www.vupen.com/english/advisories/2006/3197
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28254
- https://www.exploit-db.com/exploits/2130
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.