Back to Database
Status published
High
CVE-2006-2844
Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow...
Vulnerability Description
Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to (1) simple_user/pages/index.inc.php and (2) stats/pages/index.inc.php.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2006-2844
Credits & Attribution
No credits recorded in the NVD database.
References
- http://securitytracker.com/id?1016213
- http://www.vupen.com/english/advisories/2006/2109
- https://exchange.xforce.ibmcloud.com/vulnerabilities/26887
- http://www.securityfocus.com/bid/18229
- http://secunia.com/advisories/20395
- https://www.exploit-db.com/exploits/1861
- http://www.securityfocus.com/archive/1/435733/100/0/threaded
- http://securityreason.com/securityalert/1043
More from redaxo
View All →CVE-2025-66026
REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]
Medium
6.1
CVE-2025-27412
REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation
Medium
6.1
CVE-2025-27411
REDAXO allows Arbitrary File Upload in the mediapool page
Medium
5.4
CVE-2021-39459
Remote code execution in the modules component in Yakamara Media...
High
7.2
CVE-2021-39458
Triggering an error page of the import process in Yakamara...
Medium
6.5
Affected Vendor
redaxo
View all reports →Affected Software
redaxo
Vulnerable Versions:
3.0
Timeline
Official Publish:
June 6th, 2006
Last Modified:
August 7th, 2024
Added to House:
July 18th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.