PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a URL in the…

Description

PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[AA_INC_PATH] parameter in (1) cached.php3, (2) cron.php3, (3) discussion.php3, (4) filldisc.php3, (5) filler.php3, (6) fillform.php3, (7) go.php3, (8) hiercons.php3, (9) jsview.php3, (10) live_checkbox.php3, (11) offline.php3, (12) post2shtml.php3, (13) search.php3, (14) slice.php3, (15) sql_update.php3, (16) view.php3, (17) multiple files in the (18) admin/ folder, (19) includes folder, and (20) modules/ folder.

Scores

EPSS (exploitation in 30 days)

13.6% · top 3.5% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.4.

Weakness

• n/a
• CWE-94 (opens in a new tab)All about CWE-94 and its CVEs

Affected products

• n/a

  • affected n/a

References (61)

• 27308 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27289 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27304 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27269 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27256 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 1829 (opens in a new tab)exploitx_refsource_EXPLOIT-DBx_transferred
• 27275 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27270 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27292 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• actionapps-globals-file-include(26776) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• ADV-2006-1997 (opens in a new tab)vdb-entryx_refsource_VUPENx_transferred
• 27305 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27272 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27278 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27294 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27273 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27287 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27274 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27284 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27253 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27276 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27306 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27263 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27298 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27295 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27271 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27288 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27310 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27264 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27262 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27257 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27259 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27280 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 20299 (opens in a new tab)third-party-advisoryx_refsource_SECUNIAx_transferred
• 27309 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27291 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27267 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27281 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27282 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27301 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27254 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27268 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27258 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27299 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27300 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27297 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27285 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27286 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27296 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27303 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27279 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27277 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 19133 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 27283 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27261 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27302 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27260 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27266 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27290 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27293 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 27265 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2006-2686](https://trackcve.app/badge/CVE-2006-2686.svg)](https://trackcve.app/cve/CVE-2006-2686)

Record last updated 7 Aug 2024, 17:58 UTC.