CVE-2006-3847

PHP remote file inclusion vulnerability in (1) admin.php, and possibly (2) details.php, (3) modify.php, (4) newgroup.php, (5) newtask.php, and (6) rss.php, in MoSpray (aka com_mospray) 1.8 RC1 allows remote attackers to execute arbitrary PHP code via a URL in the basedir parameter.

• CWE-94

• http://kurdishsecurity.blogspot.com/2006/07/kurdish-security-14-mospray-basedir.htmlExploit
• http://secunia.com/advisories/21166Vendor Advisory
• http://www.securityfocus.com/archive/1/440939/100/200/threaded
• http://www.securityfocus.com/bid/19122
• http://www.vupen.com/english/advisories/2006/2932Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27917
• https://www.exploit-db.com/exploits/2062
• http://kurdishsecurity.blogspot.com/2006/07/kurdish-security-14-mospray-basedir.htmlExploit
• http://secunia.com/advisories/21166Vendor Advisory
• http://www.securityfocus.com/archive/1/440939/100/200/threaded
• http://www.securityfocus.com/bid/19122
• http://www.vupen.com/english/advisories/2006/2932Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27917
• https://www.exploit-db.com/exploits/2062

Published

Jul 25, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-3841Cross-site scripting (XSS) vulnerability in WebScarab before…
• CVE-2006-3842Cross-site scripting (XSS) vulnerability in Zoho Virtual Off…
• CVE-2006-3843PHP remote file inclusion vulnerability in com_calendar.php …
• CVE-2006-3844Buffer overflow in Quick 'n Easy FTP Server 3.0 allows remot…
• CVE-2006-3845Stack-based buffer overflow in lzh.fmt in WinRAR 3.00 throug…
• CVE-2006-3846PHP remote file inclusion vulnerability in extadminmenus.cla…
• CVE-2006-3848Cross-site scripting (XSS) vulnerability in CGI wrapper for …
• CVE-2006-3849Stack-based buffer overflow in Warzone 2100 and Warzone Resu…
• CVE-2006-3850PHP remote file inclusion vulnerability in upgrader.php in V…
• CVE-2006-3851SQL injection vulnerability in upgradev1.php in X7 Chat 2.0.…
• CVE-2006-3852Cross-site scripting (XSS) vulnerability in index.php in Mic…
• CVE-2006-3853Buffer overflow in IBM Informix Dynamic Server (IDS) before …