CVE-2007-2260 json
Multiple PHP remote file inclusion vulnerabilities in bibtex mase beta 2.0 allow remote attackers to execute arbitrary PHP code via a URL i…
published 2007-04-25 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-2255
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.5%
- EPSS 2.5% chance of exploitation in 30 days, percentile 84%
- public exploits
- 0
- none known
Summary
Multiple PHP remote file inclusion vulnerabilities in bibtex mase beta 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the bibtexrootrel parameter to (1) unavailable.php, (2) source.php, (3) log.php, (4) latex.php, (5) indexinfo.php, (6) index.php, (7) importinfo.php, (8) import.php, (9) examplefile.php, (10) clearinfo.php, (11) clear.php, (12) aboutinfo.php, (13) about.php, and other unspecified files.
Exploit prediction
2.46% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
osvdb.org
/35628
vdb-entry
-
osvdb.org
/35624
vdb-entry
-
osvdb.org
/35631
vdb-entry
-
osvdb.org
/35633
vdb-entry
-
osvdb.org
/35629
vdb-entry
-
osvdb.org
/35622
vdb-entry
-
osvdb.org
/35621
vdb-entry
-
securityfocus.com
/archive/1/466683/100/0/threaded
mailing-list
-
osvdb.org
/35625
vdb-entry
-
osvdb.org
/35623
vdb-entry
-
osvdb.org
/35632
vdb-entry
-
securityreason.com
/securityalert/2624
third-party-advisory
-
osvdb.org
/35626
vdb-entry
-
osvdb.org
/35630
vdb-entry
-
osvdb.org
/35627
vdb-entry
Sources
- CVE List CVE-2007-2260
- NVD CVE-2007-2260
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.