CVE-2006-2811 in the critical feed json
Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrary PHP code via a UR…
published 2006-06-05 20 y ago modified 2026-06-16 4 mo ago also EUVD-2006-2808
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 17.4%
- EPSS 17.4% chance of exploitation in 30 days, percentile 97%
- public exploits
- 8
- Exploit-DB
Summary
Multiple PHP remote file inclusion vulnerabilities in Cantico Ovidentia 5.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the babInstallPath parameter in (1) index.php, (2) topman.php, (3) approb.php, (4) vacadmb.php, (5) vacadma.php, (6) vacadm.php, (7) statart.php, (8) search.php, (9) posts.php, (10) options.php, (11) login.php, (12) frchart.php, (13) flbchart.php, (14) fileman.php, (15) faq.php, (16) event.php, (17) directory.php, (18) articles.php, (19) artedit.php, (20) calday.php, and additional unspecified PHP scripts. NOTE: the utilit.php vector is already covered by CVE-2005-1964.
Timeline
- First public exploit (EDB-27956)
- Published
Exploit prediction
17.39% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-27956 Ovidentia 5.6.x/5.8 - 'options.php?babInstallPath' Remote File Inclusion webapps, 2006-06-02
- EDB-27955 Ovidentia 5.6.x/5.8 - 'posts.php?babInstallPath' Remote File Inclusion webapps, 2006-06-02
- EDB-27954 Ovidentia 5.6.x/5.8 - 'search.php?babInstallPath' Remote File Inclusion webapps, 2006-06-02
- EDB-27953 Ovidentia 5.6.x/5.8 - 'statart.php?babInstallPath' Remote File Inclusion webapps, 2006-06-02
- EDB-27952 Ovidentia 5.6.x/5.8 - 'vacadm.php?babInstallPath' Remote File Inclusion webapps, 2006-06-02
- EDB-27951 Ovidentia 5.6.x/5.8 - 'vacadma.php?babInstallPath' Remote File Inclusion webapps, 2006-06-02
- EDB-27950 Ovidentia 5.6.x/5.8 - 'vacadmb.php?babInstallPath' Remote File Inclusion webapps, 2006-06-02
- EDB-27949 Ovidentia 5.6.x/5.8 - 'approb.php?babInstallPath' Remote File Inclusion webapps, 2006-06-02
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
osvdb.org
/27223
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/26981
vdb-entry
-
osvdb.org
/27228
vdb-entry
-
osvdb.org
/27215
vdb-entry
-
osvdb.org
/27224
vdb-entry
-
osvdb.org
/27214
vdb-entry
-
securityreason.com
/securityalert/1033
third-party-advisory
-
osvdb.org
/27216
vdb-entry
-
osvdb.org
/27212
vdb-entry
-
osvdb.org
/27222
vdb-entry
-
osvdb.org
/27221
vdb-entry
-
osvdb.org
/27226
vdb-entry
-
osvdb.org
/27220
vdb-entry
-
osvdb.org
/27225
vdb-entry
-
osvdb.org
/27211
vdb-entry
-
osvdb.org
/27229
vdb-entry
-
securityfocus.com
/bid/18232
vdb-entry
-
securityfocus.com
/archive/1/456893/100/200/threaded
mailing-list
-
osvdb.org
/27209
vdb-entry
-
osvdb.org
/27218
vdb-entry
-
osvdb.org
/27217
vdb-entry
-
osvdb.org
/27227
vdb-entry
-
osvdb.org
/27213
vdb-entry
-
securityfocus.com
/archive/1/435590/100/0/threaded
mailing-list
-
osvdb.org
/27219
vdb-entry
-
securityfocus.com
/archive/1/459572/100/0/threaded
mailing-list
Sources
- CVE List CVE-2006-2811
- NVD CVE-2006-2811
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.