CVEvulnerability
CVE-2006-1371
9.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2006-03-23
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
- Weaknesses
- CWE-94
Description
Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5 and earlier allows remote authenticated users to use the HTMLArea FileManager plugin to upload and execute arbitrary PHP files using (1) manager.php, (2) standalonemanager.php, and (3) images.php.
Affected configurations
• xhp cms (<= 0.5)
Related
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- http://secunia.com/advisories/19353 Exploit, Patch, Vendor Advisory
- http://www.attrition.org/pipermail/vim/2006-March/000649.html www.attrition.org
- http://www.osvdb.org/24058 www.osvdb.org
- http://www.osvdb.org/24059 www.osvdb.org
- http://www.securityfocus.com/bid/17209 www.securityfocus.com
- http://www.vupen.com/english/advisories/2006/1052 Vendor Advisory
- http://xhp.targetit.ro/index.php?page=3&box_id=34&action=show_single_entry&post_id=10 xhp.targetit.ro
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25399 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/1605 www.exploit-db.com
- http://secunia.com/advisories/19353 Exploit, Patch, Vendor Advisory
- http://www.attrition.org/pipermail/vim/2006-March/000649.html www.attrition.org
- http://www.osvdb.org/24058 www.osvdb.org
- http://www.osvdb.org/24059 www.osvdb.org
- http://www.securityfocus.com/bid/17209 www.securityfocus.com
- http://www.vupen.com/english/advisories/2006/1052 Vendor Advisory
- http://xhp.targetit.ro/index.php?page=3&box_id=34&action=show_single_entry&post_id=10 xhp.targetit.ro
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25399 exchange.xforce.ibmcloud.com
- https://www.exploit-db.com/exploits/1605 www.exploit-db.com