CVE-2006-4470

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Joomla! before 1.0.11 omits some checks for whether _VALID_MOS is defined, which allows attackers to have an unknown impact, possibly resulting in PHP remote file inclusion.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/21666Third Party Advisory
http://www.joomla.org/content/view/1841/78/Vendor Advisory
http://www.joomla.org/content/view/1843/74/Vendor Advisory
http://www.vupen.com/english/advisories/2006/3408Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/28631Third Party Advisory, VDB Entry
http://secunia.com/advisories/21666Third Party Advisory
http://www.joomla.org/content/view/1841/78/Vendor Advisory
http://www.joomla.org/content/view/1843/74/Vendor Advisory
http://www.vupen.com/english/advisories/2006/3408Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/28631Third Party Advisory, VDB Entry

Timeline

Published: Aug 31, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-44716.5The Admin Upload Image functionality in Joomla! before 1.0.11 allows remote authenticated users to upload files outside of the /images/stori CVE-2006-44727.5Multiple unspecified vulnerabilities in Joomla! before 1.0.11 allow attackers to bypass user authentication via unknown vectors involving th CVE-2006-44735.1Unspecified vulnerability in com_content in Joomla! before 1.0.11, when $mosConfig_hideEmail is set, allows attackers to perform the emailfo CVE-2006-44746.8Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.0.11 allow remote attackers to inject arbitrary web script or HTML v CVE-2006-44757.5Joomla! before 1.0.11 does not limit access to the Admin Popups functionality, which has unknown impact and attack vectors.CVE-2006-44767.5Multiple unspecified vulnerabilities in Joomla! before 1.0.11, related to "Injection Flaws," allow attackers to have an unknown impact via (CVE-2006-44777.5Multiple PHP remote file inclusion vulnerabilities in Visual Shapers ezContents 2.0.3 allow remote attackers to execute arbitrary PHP code v CVE-2006-44787.5SQL injection vulnerability in headeruserdata.php in Visual Shapers ezContents 2.0.3 allows remote attackers to execute arbitrary SQL comman CVE-2006-44794.3Cross-site scripting (XSS) vulnerability in loginreq2.php in Visual Shapers ezContents 2.0.3 allows remote attackers to inject arbitrary web CVE-2006-44804.3Incomplete blacklist vulnerability in the nk_CSS function in nuked.php in Nuked-Klan 1.7 SP4.3 allows remote attackers to bypass anti-XSS fe CVE-2006-44817.2The (1) file_exists and (2) imap_reopen functions in PHP before 5.1.5 do not check for the safe_mode and open_basedir settings, which allows CVE-2006-44829.3Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5, when use