CVE-2006-3850

PHP remote file inclusion vulnerability in upgrader.php in Vanilla CMS 1.0.1 and earlier, when /conf/old_settings.php exists, allows remote attackers to execute arbitrary PHP code via a URL in the RootDirectory parameter. NOTE: this issue has been disputed by a third party who states that the RootDirectory parameter is initialized before being used, for version 1.0. CVE analysis concurs with the dispute, but it is unclear whether older versions are affected

• http://securityreason.com/securityalert/1281
• http://securitytracker.com/id?1016568
• http://www.attrition.org/pipermail/vim/2006-July/000937.html
• http://www.attrition.org/pipermail/vim/2006-July/000944.html
• http://www.osvdb.org/28287
• http://www.securityfocus.com/archive/1/440938/100/0/threaded
• http://www.securityfocus.com/archive/1/442450/100/0/threaded
• http://www.securityfocus.com/bid/19127Exploit
• http://securityreason.com/securityalert/1281
• http://securitytracker.com/id?1016568
• http://www.attrition.org/pipermail/vim/2006-July/000937.html
• http://www.attrition.org/pipermail/vim/2006-July/000944.html
• http://www.osvdb.org/28287
• http://www.securityfocus.com/archive/1/440938/100/0/threaded
• http://www.securityfocus.com/archive/1/442450/100/0/threaded
• http://www.securityfocus.com/bid/19127Exploit

Published

Jul 25, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-3844Buffer overflow in Quick 'n Easy FTP Server 3.0 allows remot…
• CVE-2006-3845Stack-based buffer overflow in lzh.fmt in WinRAR 3.00 throug…
• CVE-2006-3846PHP remote file inclusion vulnerability in extadminmenus.cla…
• CVE-2006-3847PHP remote file inclusion vulnerability in (1) admin.php, an…
• CVE-2006-3848Cross-site scripting (XSS) vulnerability in CGI wrapper for …
• CVE-2006-3849Stack-based buffer overflow in Warzone 2100 and Warzone Resu…
• CVE-2006-3851SQL injection vulnerability in upgradev1.php in X7 Chat 2.0.…
• CVE-2006-3852Cross-site scripting (XSS) vulnerability in index.php in Mic…
• CVE-2006-3853Buffer overflow in IBM Informix Dynamic Server (IDS) before …
• CVE-2006-3854Buffer overflow in IBM Informix Dynamic Server (IDS) 9.40.TC…
• CVE-2006-3855The ifx_load_internal function in IBM Informix Dynamic Serve…
• CVE-2006-3856IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 …