CVE-2006-2860

PHP remote file inclusion vulnerability in Webspotblogging 3.0.1 allows remote attackers to execute arbitrary PHP code via a URL in the path parameter to (1) inc/logincheck.inc.php, (2) inc/adminheader.inc.php, (3) inc/global.php, or (4) inc/mainheader.inc.php. NOTE: some of these vectors were also reported for 3.0 in a separate disclosure.

• CWE-94

• http://arfis.wordpress.com/2007/09/14/rfi-02-webspotblogging/
• http://secunia.com/advisories/20439Exploit, Vendor Advisory
• http://www.osvdb.org/25992
• http://www.osvdb.org/25993
• http://www.osvdb.org/25994
• http://www.osvdb.org/25995
• http://www.securityfocus.com/archive/1/447001/100/0/threaded
• http://www.securityfocus.com/archive/1/447576/100/200/threaded
• http://www.securityfocus.com/bid/18260Exploit
• http://www.vupen.com/english/advisories/2006/2127Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26910
• https://www.exploit-db.com/exploits/1871
• http://arfis.wordpress.com/2007/09/14/rfi-02-webspotblogging/
• http://secunia.com/advisories/20439Exploit, Vendor Advisory
• http://www.osvdb.org/25992
• http://www.osvdb.org/25993
• http://www.osvdb.org/25994
• http://www.osvdb.org/25995
• http://www.securityfocus.com/archive/1/447001/100/0/threaded
• http://www.securityfocus.com/archive/1/447576/100/200/threaded
• http://www.securityfocus.com/bid/18260Exploit
• http://www.vupen.com/english/advisories/2006/2127Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26910
• https://www.exploit-db.com/exploits/1871

Published

Jun 6, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-2854SQL injection vulnerability in index.php in iBWd Guestbook 1…
• CVE-2006-2855SQL injection vulnerability in index.php in xueBook 1.0 allo…
• CVE-2006-2856ActiveState ActivePerl 5.8.8.817 for Windows configures the …
• CVE-2006-2857SQL injection vulnerability in index.php in LifeType 1.0.4 a…
• CVE-2006-2858SQL injection vulnerability in viewmsg.asp in LocazoList Cla…
• CVE-2006-2859PHP remote file inclusion vulnerability in MyBloggie 2.1.1 a…
• CVE-2006-2861SQL injection vulnerability in index.php in Particle Wiki 1.…
• CVE-2006-2862SQL injection vulnerability in viewimage.php in Particle Gal…
• CVE-2006-2863PHP remote file inclusion vulnerability in class.cs_phpmaile…
• CVE-2006-2864Multiple PHP remote file inclusion vulnerabilities in BlueSh…
• CVE-2006-2865PHP remote file inclusion vulnerability in template.php in p…
• CVE-2006-2866PHP remote file inclusion vulnerability in layout/prepend.ph…