CVE-2006-2395

PHP remote file inclusion vulnerability in resources/includes/popp.config.loader.inc.php in PopSoft Digital PopPhoto Studio 3.5.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter (cfg['popphoto_base_path'] variable). NOTE: Pixaria has notified CVE that "PopPhoto is NOT a product of Pixaria. It was a product of PopSoft Digital and is only hosted by Pixaria as a courtesy... The vulnerability listed was patched by the previous vendor and all previous users have received this update."

• CWE-94

• http://pridels0.blogspot.com/2006/05/popphoto-remote-file-inclusion-vuln.html
• http://secunia.com/advisories/20087Vendor Advisory
• http://securitytracker.com/id?1016092
• http://www.attrition.org/pipermail/vim/2006-June/000869.html
• http://www.osvdb.org/25524
• http://www.pixaria.com/news/article/35/URL Repurposed
• http://www.securityfocus.com/bid/17970
• http://www.vupen.com/english/advisories/2006/1792Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26449
• http://pridels0.blogspot.com/2006/05/popphoto-remote-file-inclusion-vuln.html
• http://secunia.com/advisories/20087Vendor Advisory
• http://securitytracker.com/id?1016092
• http://www.attrition.org/pipermail/vim/2006-June/000869.html
• http://www.osvdb.org/25524
• http://www.pixaria.com/news/article/35/URL Repurposed
• http://www.securityfocus.com/bid/17970
• http://www.vupen.com/english/advisories/2006/1792Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26449

Published

May 16, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-2389Unspecified vulnerability in Microsoft Office 2003 SP1 and S…
• CVE-2006-2390Cross-site scripting (XSS) vulnerability in OZJournals 1.2 a…
• CVE-2006-2391Buffer overflow in EMC Retrospect Client 5.1 through 7.5 all…
• CVE-2006-2392PHP remote file inclusion vulnerability in public_includes/p…
• CVE-2006-2393The client_cmd function in Empire 4.3.2 and earlier allows r…
• CVE-2006-2394Cross-site scripting (XSS) vulnerability in chat.php in PHP …
• CVE-2006-2396Cross-site scripting (XSS) vulnerability in phpODP 1.5h allo…
• CVE-2006-2397Multiple cross-site scripting (XSS) vulnerabilities in GPhot…
• CVE-2006-2398Directory traversal vulnerability in index.php in GPhotos 1.…
• CVE-2006-2399Stack-based buffer overflow in the ServerNetworking::incomin…
• CVE-2006-2400The leetnet functions (leetnet/rudp.cpp) in Outgun 1.0.3 bot…
• CVE-2006-2401The leetnet functions (leetnet/rudp.cpp) in Outgun 1.0.3 bot…