CVE-2007-0987

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Directory traversal vulnerability in index.php in Jupiter CMS 1.1.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot), or an absolute pathname, in the n parameter.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://mgsdl.free.fr/advisories/12070214.txtExploit, Vendor Advisory
http://osvdb.org/33731
http://www.acid-root.new.fr/advisories/12070214.txtExploit, Vendor Advisory
http://www.securityfocus.com/archive/1/460076/100/0/threaded
http://www.securityfocus.com/archive/1/460100/100/0/threaded
http://www.securityfocus.com/bid/22560Exploit
https://www.exploit-db.com/exploits/3309
http://mgsdl.free.fr/advisories/12070214.txtExploit, Vendor Advisory
http://osvdb.org/33731
http://www.acid-root.new.fr/advisories/12070214.txtExploit, Vendor Advisory
http://www.securityfocus.com/archive/1/460076/100/0/threaded
http://www.securityfocus.com/archive/1/460100/100/0/threaded
http://www.securityfocus.com/bid/22560Exploit
https://www.exploit-db.com/exploits/3309

Timeline

Published: Feb 16, 2007
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2007

CVE-2007-09884.3The zend_hash_init function in PHP 5 before 5.2.1 and PHP 4 before 4.4.5, when running on a 64-bit platform, allows context-dependent attack CVE-2007-09946.8A regression error in Mozilla Firefox 2.x before 2.0.0.2 and 1.x before 1.5.0.10, and SeaMonkey 1.1 before 1.1.1 and 1.0 before 1.0.8, allow CVE-2007-09954.3Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 ignores trailing invalid HTML characters in attribute nam CVE-2007-09965.8The child frames in Mozilla Firefox before 1.5.0.10 and 2.x before 2.0.0.2, and SeaMonkey before 1.0.8 inherit the default charset from the CVE-2007-09976.9Race condition in the tee (sys_tee) system call in the Linux kernel 2.6.17 through 2.6.17.6 might allow local users to cause a denial of ser CVE-2007-09984.3The VNC server implementation in QEMU, as used by Xen and possibly other environments, allows local users of a guest operating system to rea CVE-2007-09999.3Format string vulnerability in Ekiga 2.0.3, and probably other versions, allows remote attackers to execute arbitrary code via unspecified v CVE-2007-10007.2The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c in the Linux kernel before 2.6.20.2 allows local users to read arbitrary ker CVE-2007-100017.5A vulnerability classified as problematic has been found in web-cyradm. This affects an unknown part of the file search.php. The manipulatio CVE-2007-100029.8A vulnerability, which was classified as critical, has been found in web-cyradm. Affected by this issue is some unknown functionality of the CVE-2007-100038.8A vulnerability, which was classified as critical, has been found in The Hackers Diet Plugin up to 0.9.6b on WordPress. This issue affects s CVE-2007-10016.8Multiple integer overflows in the (1) createwbmp and (2) readwbmp functions in wbmp.c in the GD library (libgd) in PHP 4.0.0 through 4.4.6 a