CVE-2007-5223 json
Multiple unspecified vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to include local files and have other unspe…
published 2007-10-05 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-5203
- cvss
- 6.8
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 73%
- public exploits
- 0
- none known
Summary
Multiple unspecified vulnerabilities in AlstraSoft Affiliate Network Pro allow remote attackers to include local files and have other unspecified impact, related to incorrect input validation or other defects involving (1) admin/backupstart.php, (2) a .sql filename under admin/admin/dump/, (3) a .sql filename in the fl parameter to admin/downloadbackup.php, and (4) a .. (dot dot) in the fl parameter to admin/downloadbackup.php.
Exploit prediction
1.42% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-264 Permissions, Privileges, and Access Controls
References
-
osvdb.org
/42342
vdb-entry
-
securityfocus.com
/archive/1/481206/100/0/threaded
mailing-list
-
osvdb.org
/42344
vdb-entry
-
osvdb.org
/42343
vdb-entry
-
securityfocus.com
/bid/25882
vdb-entry
-
securityreason.com
/securityalert/3191
third-party-advisory
-
vupen.com
/english/advisories/2007/3344
vdb-entry
Sources
- CVE List CVE-2007-5223
- NVD CVE-2007-5223
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.