CVE-2006-4074

PHP remote file inclusion vulnerability in lib/tpl/default/main.php in the JD-Wiki Component (com_jd-wiki) 1.0.2 and earlier for Joomla!, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.

• CWE-94

• http://secunia.com/advisories/21389Exploit, Patch, Vendor Advisory
• http://www.joomladeveloping.org/component/option%2Ccom_jd-wp/Itemid%2C29/p%2C33/
• http://www.securityfocus.com/bid/19373Exploit, Patch
• http://www.vupen.com/english/advisories/2006/3192
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28253
• https://www.exploit-db.com/exploits/2125
• http://secunia.com/advisories/21389Exploit, Patch, Vendor Advisory
• http://www.joomladeveloping.org/component/option%2Ccom_jd-wp/Itemid%2C29/p%2C33/
• http://www.securityfocus.com/bid/19373Exploit, Patch
• http://www.vupen.com/english/advisories/2006/3192
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28253
• https://www.exploit-db.com/exploits/2125

Published

Aug 11, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-4068The pswd.js script relies on the client to calculate whether…
• CVE-2006-4069Multiple cross-site scripting (XSS) vulnerabilities in Elain…
• CVE-2006-4070Format string vulnerability in Imendio Planner 0.13 allows u…
• CVE-2006-4071Sign extension vulnerability in the createBrushIndirect func…
• CVE-2006-4072Multiple SQL injection vulnerabilities in Club-Nuke [XP] 2.0…
• CVE-2006-4073Multiple PHP remote file inclusion vulnerabilities in Fabian…
• CVE-2006-4075Multiple PHP remote file inclusion vulnerabilities in Wim Fl…
• CVE-2006-4076Multiple PHP remote file inclusion vulnerabilities in Wim Fl…
• CVE-2006-4077PHP remote file inclusion vulnerability in CheckUpload.php i…
• CVE-2006-4078pm.php (aka the PM system) in DeluxeBB 1.08, and possibly ea…
• CVE-2006-4079Cross-site scripting (XSS) vulnerability in newpost.php in D…
• CVE-2006-4080DeluxeBB 1.08, and possibly earlier, uses cookies that inclu…