VulnerabilityModified

CVE-2008-6221

PHP remote file inclusion vulnerability in config.dadamail.php in the Dada Mail Manager (com_dadamail) component 2.6 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[mosConfig_absolute_path] parameter.

EXPLOIT ✓HIGH 7.5EPSS 54.0%

Does this matter?

EPSS puts the probability of exploitation in the next 30 days at 54.0%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.

Description

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 53.98% probability · 99th percentile
Public exploits: 1 in Exploit-DB · verified · first 5 November 2008
CISA KEV: Not listed
Weakness: CWE-94
Affected: dadamailproject/dada mail manager
Source: cve@mitre.org

EPSS trend

EPSS moved from 54.0% on 29 September 2026 to 54.0% on 26 October 2026. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”.

Public exploits (1)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-7002 source ↗	Joomla! Component Dada Mail Manager 2.6 - Remote File Inclusionphp · NoGe	webapps	5 November 2008	yes

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.