CVE-2006-5220 - CVE House
Back to Database
Status published Medium CVE-2006-5220

Multiple PHP remote file inclusion vulnerabilities in WebYep 1.1.9, when...

Vulnerability Description

Multiple PHP remote file inclusion vulnerabilities in WebYep 1.1.9, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via the webyep_sIncludePath in (1) files in the programm/lib/ directory including (a) WYApplication.php, (b) WYDocument.php, (c) WYEditor.php, (d) WYElement.php, (e) WYFile.php, (f) WYHTMLTag.php, (g) WYImage.php, (h) WYLanguage.php, (i) WYLink.php, (j) WYPath.php, (k) WYPopupWindowLink.php, (l) WYSelectMenu.php, and (m) WYTextArea.php; (2) files in the programm/elements/ directory including (n) WYGalleryElement.php, (o) WYGuestbookElement.php, (p) WYImageElement.php, (q) WYLogonButtonElement.php, (r) WYLongTextElement.php, (s) WYLoopElement.php, (t) WYMenuElement.php, and (u) WYShortTextElement.php; and (3) programm/webyep.php.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2006-5220

Credits & Attribution

No credits recorded in the NVD database.

References

More from objective development

View All →
CVE-2008-4057
Unspecified vulnerability in Objective Development Sharity 3 before 3.5 has...
Critical 10
CVE-2007-2178
Multiple unspecified vulnerabilities in Objective Development Sharity before 3.3 allow...
High 7.8

Affected Vendor

objective development

View all reports →

Affected Software

webyep
Vulnerable Versions:
1.1.9

Timeline

Official Publish: October 9th, 2006
Last Modified: August 7th, 2024
Added to House: July 18th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.