VulnerabilityModified
CVE-2006-7127
Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the main_dir parameter to (1) forum/main.php and (2) forum/headlines.php.
MEDIUM 6.8EPSS 5.58%
Does this matter?
Lower severity and a low EPSS score (5.58%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the main_dir parameter to (1) forum/main.php and (2) forum/headlines.php.
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 5.58% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- salims softhouse/jaf cms
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/22143Vendor Advisory
- http://www.rahim.webd.pl/exploity/Exploits/92.txtExploit
- http://www.securityfocus.com/bid/20329Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29348
- https://www.exploit-db.com/exploits/2474/
- https://www.exploit-db.com/exploits/5317
- http://secunia.com/advisories/22143Vendor Advisory
- http://www.rahim.webd.pl/exploity/Exploits/92.txtExploit
- http://www.securityfocus.com/bid/20329Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29348
- https://www.exploit-db.com/exploits/2474/
- https://www.exploit-db.com/exploits/5317
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.