CVE-2007-1486 json
PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before 1.7.3 allows remote attackers to execut…
published 2007-03-16 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-1480
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.9%
- EPSS 2.9% chance of exploitation in 30 days, percentile 87%
- public exploits
- 0
- none known
Summary
PHP remote file inclusion vulnerability in template.class.php in Carbonize Lazarus Guestbook before 1.7.3 allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter to admin.php, probably due to a dynamic variable evaluation vulnerability.
Exploit prediction
2.93% chance of exploitation in the next 30 days, higher than 87% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
References
-
securityreason.com
/securityalert/2432
third-party-advisory
-
securityfocus.com
/archive/1/462183/100/100/threaded
mailing-list
-
vupen.com
/english/advisories/2007/0874
vdb-entry
-
securityfocus.com
/archive/1/463041/100/0/threaded
mailing-list
- carbonize.co.uk /Lazarus/Forum/index.php?topic=1164.0
-
securityfocus.com
/archive/1/462235/100/100/threaded
mailing-list
-
attrition.org
/pipermail/vim/2007-March/001417.html
mailing-list
-
securityfocus.com
/archive/1/469218/100/0/threaded
mailing-list
Sources
- CVE List CVE-2007-1486
- NVD CVE-2007-1486
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.