CVE-2006-6224

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

PHP remote file inclusion vulnerability in the installation scripts in Puntal before 1.8.5 allows remote attackers to execute arbitrary PHP code via the GLOBALS array.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.puntal.fr/forums/viewtopic.php?id=610Patch, Vendor Advisory
http://www.securityfocus.com/bid/21357Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2006/4767
https://exchange.xforce.ibmcloud.com/vulnerabilities/30585
http://www.puntal.fr/forums/viewtopic.php?id=610Patch, Vendor Advisory
http://www.securityfocus.com/bid/21357Patch, Vendor Advisory
http://www.vupen.com/english/advisories/2006/4767
https://exchange.xforce.ibmcloud.com/vulnerabilities/30585

Timeline

Published: Dec 2, 2006
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2006

CVE-2006-62255.1Multiple PHP remote file inclusion vulnerabilities in GeekLog 1.4 allow remote attackers to execute arbitrary code via a URL in the _CONF[pa CVE-2006-62267.5Multiple format string vulnerabilities in NeoEngine 0.8.2 and earlier, and CVS 3422, allow remote attackers to cause a denial of service and CVE-2006-62275.0The Core::Receive function in neonet/core.cpp for NeoEngine 0.8.2 and earlier, and CVS 3422, allow remote attackers to cause a denial of ser CVE-2006-62286.8Cross-site scripting (XSS) vulnerability in Codewalkers ltwCalendar (aka PHP Event Calendar) before 4.2.1 allows remote attackers to inject CVE-2006-62295.0Codewalkers ltwCalendar (aka PHP Event Calendar) before 4.2.1 logs failed passwords, which might allow attackers to infer correct passwords CVE-2006-62307.5SQL injection vulnerability in vuBB 0.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter in a CVE-2006-62315.0vuBB 0.2.1 and earlier allows remote attackers to obtain sensitive information via a direct request to includes/vubb.php, which leaks the pa CVE-2006-62327.5PHP remote file inclusion vulnerability in admin/index.php in DreamAccount 3.1 allows remote attackers to execute arbitrary PHP code via a U CVE-2006-62337.5SQL injection vulnerability in the Downloads module for unknown versions of PostNuke allows remote attackers to execute arbitrary SQL comman CVE-2006-62347.5Multiple SQL injection vulnerabilities in the Content module in PHP-Nuke 6.0, and possibly other versions, allow remote attackers to execute CVE-2006-623510.0A "stack overwrite" vulnerability in GnuPG (gpg) 1.x before 1.4.6, 2.x before 2.0.2, and 1.9.0 through 1.9.95 allows attackers to execute ar CVE-2006-62369.3Adobe Reader (Adobe Acrobat Reader) 7.0 through 7.0.8 allows remote attackers to cause a denial of service and possibly execute arbitrary co