Unscored severity · published Feb 21, 2006
CVE-2006-0824
Multiple unspecified vulnerabilities in lib-common.php in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to include arbitrary local files and…
–
CVSS
3.1%
EPSS
No
On KEV
Description
Multiple unspecified vulnerabilities in lib-common.php in Geeklog 1.4.0 before 1.4.0sr1 and 1.3.11 before 1.3.11sr4 allow remote attackers to include arbitrary local files and execute arbitrary code via (1) absolute paths in unspecified parameters and (2) the language cookie, as demonstrated for code execution using error.log.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
Geeklog · Geeklog
1.3.11; 1.3.11_sr1; 1.3.11_sr2; 1.3.11_sr3; 1.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-0824
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-0824
Patch
http://secunia.com/advisories/18920
Patch
http://www.geeklog.net/article.php/geeklog-1.4.0sr1
www.gulftech.org
http://www.gulftech.org/?node=research&article_id=00102-02192006
www.osvdb.org
http://www.osvdb.org/23349
www.securityfocus.com
http://www.securityfocus.com/archive/1/425506/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/16755
More from Geeklog
4.8
CVE-2023-46058
Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the grp_desc parameter of the…
4.8
CVE-2023-46059
Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted payload to the Service, and website URL…
4.8
CVE-2023-37787
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Rule and…
4.8
CVE-2023-37786
Multiple cross-site scripting (XSS) vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Mail…
–
CVE-2013-1470
Cross-site scripting (XSS) vulnerability in calendar/index.php in the Calendar plugin in Geeklog before 1.8.2sr1 and 2.0.0 before 2.0.0rc2 allows remote attackers to inject…