CVE-2006-5380
published 2006-10-18CVE-2006-5380: Remote file inclusion vulnerability in Contenido CMS allows remote attackers to execute arbitrary PHP code via a URL in the contenido_path parameter to (1)…
PriorityP430high7.5CVSS 2.0
AVNACLAuNCPIPAP
EPSS
1.51%
71.2th percentile
Remote file inclusion vulnerability in Contenido CMS allows remote attackers to execute arbitrary PHP code via a URL in the contenido_path parameter to (1) cms/dbfs.php or (2) cms/front_content.php. NOTE: CVE disputes this issue for version 4.6.15, because $contenido_path is set to a static value
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| contenido | contendio | — | — |
| contenido | contenido_cms | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-42q3-f5fp-gpxr: ** DISPUTED ** Remote file inclusion vulnerability in Contenido CMS allows remote attackers to execute arbitrary PHP code via a URL in the contenido_p
ghsa_unreviewed·2022-05-01
CVE-2006-5380 [HIGH] GHSA-42q3-f5fp-gpxr: ** DISPUTED ** Remote file inclusion vulnerability in Contenido CMS allows remote attackers to execute arbitrary PHP code via a URL in the contenido_p
** DISPUTED ** Remote file inclusion vulnerability in Contenido CMS allows remote attackers to execute arbitrary PHP code via a URL in the contenido_path parameter to (1) cms/dbfs.php or (2) cms/front_content.php. NOTE: CVE disputes this issue for version 4.6.15, because $contenido_path is set to a static value.
GHSA
GHSA-wc34-94x4-v5r4: Multiple PHP remote file inclusion vulnerabilities in Contenido CMS 4
ghsa_unreviewed·2022-05-01·CVSS 7.5
CVE-2008-2912 [HIGH] CWE-94 GHSA-wc34-94x4-v5r4: Multiple PHP remote file inclusion vulnerabilities in Contenido CMS 4
Multiple PHP remote file inclusion vulnerabilities in Contenido CMS 4.8.4 allow remote attackers to execute arbitrary PHP code via a URL in the (1) contenido_path parameter to (a) contenido/backend_search.php; the (2) cfg[path][contenido] parameter to (b) move_articles.php, (c) move_old_stats.php, (d) optimize_database.php, (e) run_newsletter_job.php, (f) send_reminder.php, (g) session_cleanup.php, and (h) setfrontenduserstate.php in contenido/cronjobs/, and (i) includes/include.newsletter_jobs_subnav.php and (j) plugins/content_allocation/includes/include.right_top.php in contenido/; the (3) cfg[path][templates] parameter to (k) includes/include.newsletter_jobs_subnav.php and (l) plugins/content_allocation/includes/include.right_top.php in contenido/; and the (4) cfg[templates][right_top_
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://securityreason.com/securityalert/1739http://www.attrition.org/pipermail/vim/2006-October/001084.htmlhttp://www.securityfocus.com/archive/1/448549/100/0/threadedhttps://exchange.xforce.ibmcloud.com/vulnerabilities/29549http://securityreason.com/securityalert/1739http://www.attrition.org/pipermail/vim/2006-October/001084.htmlhttp://www.securityfocus.com/archive/1/448549/100/0/threadedhttps://exchange.xforce.ibmcloud.com/vulnerabilities/29549
2006-10-18
Published