9.8
CVE-2006-3136
- EPSS 2.1%
- Veröffentlicht 22.06.2006 22:06:00
- Zuletzt bearbeitet 03.04.2025 01:03:51
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginMultiple PHP remote file inclusion vulnerabilities in Nucleus 3.23 allow remote attackers to execute arbitrary PHP code via a URL the DIR_LIBS parameter in (1) path/action.php, and to files in path/nucleus including (2) media.php, (3) /xmlrpc/server.php, and (4) /xmlrpc/api_metaweblog.inc.php. NOTE: this is a similar vulnerability to CVE-2006-2583. NOTE: this issue has been disputed by third parties, who state that the DIR_LIBS parameter is defined in an include file before being used
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Nucleus Group ≫ Nucleus Cms Version3.0
Nucleus Group ≫ Nucleus Cms Version3.0_1
Nucleus Group ≫ Nucleus Cms Version3.0_rc
Nucleus Group ≫ Nucleus Cms Version3.1
Nucleus Group ≫ Nucleus Cms Version3.2
Nucleus Group ≫ Nucleus Cms Version3.21
Nucleus Group ≫ Nucleus Cms Version3.22
Nucleus Group ≫ Nucleus Cms Version3.23
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 2.1% | 0.834 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 9.8 | 3.9 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-94 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.