CVE-2007-4738 in the critical feed json
Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrar…
published 2007-09-06 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-4719
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 10.7%
- EPSS 10.7% chance of exploitation in 30 days, percentile 95%
- public exploits
- 1
- Exploit-DB
Summary
Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) db_conf or (2) ADODB_DIR parameter to utils/stphpimage_show.php; or a URL in the STPHPLIB_DIR parameter to (3) stphpbutton.php, (4) stphpcheckbox.php, (5) stphpcheckboxwithcaption.php, (6) stphpcheckgroup.php, (7) stphpcomponent.php, (8) stphpcontrolwithcaption.php, (9) stphpedit.php, (10) stphpeditwithcaption.php, (11) stphphr.php, (12) stphpimage.php, (13) stphpimagewithcaption.php, (14) stphplabel.php, (15) stphplistbox.php, (16) stphplistboxwithcaption.php, (17) stphplocale.php, (18) stphppanel.php, (19) stphpradiobutton.php, (20) stphpradiobuttonwithcaption.php, (21) stphpradiogroup.php, (22) stphprichbutton.php, (23) stphpspacer.php, (24) stphptable.php, (25) stphptablecell.php, (26) stphptablerow.php, (27) stphptabpanel.php, (28) stphptabtitle.php, (29) stphptextarea.php, (30) stphptextareawithcaption.php, (31) stphptoolbar.php, (32) stphpwindow.php, (33) stphpxmldoc.php, or (34) stphpxmlelement.php, a different set of vectors than CVE-2007-4737. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Timeline
- First public exploit (EDB-4358)
- Published
Exploit prediction
10.66% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-4358 STPHPLibrary - 'STPHPLIB_DIR' Remote File Inclusion webapps, 2007-09-03
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Classification
References
-
secunia.com
/advisories/26658
third-party-advisory, vendor-advisory
-
osvdb.org
/39077
vdb-entry
-
osvdb.org
/39082
vdb-entry
-
osvdb.org
/39088
vdb-entry
-
osvdb.org
/39076
vdb-entry
-
osvdb.org
/39090
vdb-entry
-
osvdb.org
/39085
vdb-entry
-
osvdb.org
/39079
vdb-entry
-
osvdb.org
/39093
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/36417
vdb-entry
-
osvdb.org
/39099
vdb-entry
-
osvdb.org
/39096
vdb-entry
-
osvdb.org
/39102
vdb-entry
-
osvdb.org
/39101
vdb-entry
-
osvdb.org
/39095
vdb-entry
-
osvdb.org
/39105
vdb-entry
-
osvdb.org
/39097
vdb-entry
-
osvdb.org
/39084
vdb-entry
-
osvdb.org
/39074
vdb-entry
-
osvdb.org
/39094
vdb-entry
-
osvdb.org
/39098
vdb-entry
-
osvdb.org
/39083
vdb-entry
-
osvdb.org
/39078
vdb-entry
-
osvdb.org
/39100
vdb-entry
-
osvdb.org
/39103
vdb-entry
-
osvdb.org
/39075
vdb-entry
-
osvdb.org
/39091
vdb-entry
-
securityfocus.com
/bid/25525
vdb-entry
-
osvdb.org
/39089
vdb-entry
-
osvdb.org
/39081
vdb-entry
-
osvdb.org
/39087
vdb-entry
-
osvdb.org
/39080
vdb-entry
-
osvdb.org
/39104
vdb-entry
-
osvdb.org
/39073
vdb-entry
-
osvdb.org
/39092
vdb-entry
-
osvdb.org
/39086
vdb-entry
Sources
- CVE List CVE-2007-4738
- NVD CVE-2007-4738
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.