Multiple PHP remote file inclusion vulnerabilities in Paul M. Jones Savant2, possibly when used with the com_mtree component for Mambo and…

Description

Multiple PHP remote file inclusion vulnerabilities in Paul M. Jones Savant2, possibly when used with the com_mtree component for Mambo and Joomla!, allow remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter in (1) Savant2_Plugin_stylesheet.php, (2) Savant2_Compiler_basic.php, (3) Savant2_Error_pear.php, (4) Savant2_Error_stack.php, (5) Savant2_Filter_colorizeCode.php, (6) Savant2_Filter_trimwhitespace.php, (7) Savant2_Plugin_ahref.php, (8) Savant2_Plugin_ahrefcontact.php, (9) Savant2_Plugin_ahreflisting.php, (10) Savant2_Plugin_ahreflistingimage.php, (11) Savant2_Plugin_ahrefmap.php, (12) Savant2_Plugin_ahrefownerlisting.php, (13) Savant2_Plugin_ahrefprint.php, (14) Savant2_Plugin_ahrefrating.php, (15) Savant2_Plugin_ahrefrecommend.php, (16) Savant2_Plugin_ahrefreport.php, (17) Savant2_Plugin_ahrefreview.php, (18) Savant2_Plugin_ahrefvisit.php, (19) Savant2_Plugin_checkbox.php, (20) Savant2_Plugin_cycle.php, (21) Savant2_Plugin_dateformat.php, (22) Savant2_Plugin_editor.php, (23) Savant2_Plugin_form.php, (24) Savant2_Plugin_image.php, (25) Savant2_Plugin_input.php, (26) Savant2_Plugin_javascript.php, (27) Savant2_Plugin_listalpha.php, (28) Savant2_Plugin_listingname.php, (29) Savant2_Plugin_modify.php, (30) Savant2_Plugin_mtpath.php, (31) Savant2_Plugin_options.php, (32) Savant2_Plugin_radios.php, (33) Savant2_Plugin_rating.php, or (34) Savant2_Plugin_textarea.php.

Scores

EPSS (exploitation in 30 days)

18.7% · top 2.7% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

• n/a

Affected products

• n/a

  • affected n/a

References (39)

• 28692 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28682 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28691 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 1016560 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• 28706 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28700 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28690 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28693 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28704 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 1324 (opens in a new tab)third-party-advisoryx_refsource_SREASONx_transferred
• 28679 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28699 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28686 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28709 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28698 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28696 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28697 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28703 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28702 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 20060721 [Kurdish Security # 13] Savant2 Remote File Include Vulnerability [For Mambo, Joomla] (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• 28710 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28681 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28689 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28712 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 19151 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 28708 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28683 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28684 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28688 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28685 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28711 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28687 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28707 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• savant-multiple-plugin-file-include(27906) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• 28701 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28695 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28680 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28705 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred
• 28694 (opens in a new tab)vdb-entryx_refsource_OSVDBx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2006-3990](https://trackcve.app/badge/CVE-2006-3990.svg)](https://trackcve.app/cve/CVE-2006-3990)

Record last updated 7 Aug 2024, 18:48 UTC.