CVE-2006-4749
23Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 2.1%
from disclosure to weapon0 days
Published on NVDSep 13
1st PoCAug 30
exploitation probability
2.1%top 20% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpATM) 1.20 allow remote attackers to execute arbitrary PHP code via the include_location parameter in (1) activate.php, (2) configure.php, (3) fileop.php, (4) getimg.php, (5) ipblocked.php, (6) register.php, (7) showrecent.php, (8) showtophits.php, (9) usrmanag.php, (10) viewer_bottom.php, (11) viewer_content.php, and (12) viewer_top.php. NOTE: The login.php and confirm.php vectors are already covered by CVE-2006-4594.
Affected products
n/a · n/apublic PoCs found — 1✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/2279⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.