CVE-2006-7127

Severity CVSS v4.0:
Pending analysis
Type:
CWE-94 Code Injection
Publication date:
06/03/2007
Last modified:
09/04/2025

Description

Multiple PHP remote file inclusion vulnerabilities in JAF CMS 4.0 and 4.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the main_dir parameter to (1) forum/main.php and (2) forum/headlines.php.

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:salims_softhouse:jaf_cms:4.0:rc1:*:*:*:*:*:*
cpe:2.3:a:salims_softhouse:jaf_cms:4.0:rc2:*:*:*:*:*:*