CVE-2006-4156

PHP remote file inclusion vulnerability in big.php in pearlabs mafia moblog 6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the pathtotemplate parameter. NOTE: a third party claims that the researcher is incorrect, because template.php defines pathtotemplate before big.php uses pathtotemplate. CVE has not verified either claim, but during August 2006, the original researcher made several significant errors regarding this bug type

• http://securityreason.com/securityalert/1391
• http://www.securityfocus.com/archive/1/442867/100/0/threaded
• http://www.securityfocus.com/archive/1/443153/100/0/threaded
• http://www.securityfocus.com/bid/19458
• http://securityreason.com/securityalert/1391
• http://www.securityfocus.com/archive/1/442867/100/0/threaded
• http://www.securityfocus.com/archive/1/443153/100/0/threaded
• http://www.securityfocus.com/bid/19458

Published

Aug 16, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-4143Netgear FVG318 running firmware 1.0.40 allows remote attacke…
• CVE-2006-4144Integer overflow in the ReadSGIImage function in sgi.c in Im…
• CVE-2006-4145The Universal Disk Format (UDF) filesystem driver in Linux k…
• CVE-2006-4146Buffer overflow in the (1) DWARF (dwarfread.c) and (2) DWARF…
• CVE-2006-4154Format string vulnerability in the mod_tcl module 1.0 for Ap…
• CVE-2006-4155Unspecified vulnerability in func_topic_threaded.php (aka th…
• CVE-2006-4157Cross-site scripting (XSS) vulnerability in index.php in Yet…
• CVE-2006-4158PHP remote file inclusion vulnerability in Login.php in Spam…
• CVE-2006-4159Multiple PHP remote file inclusion vulnerabilities in Chauss…
• CVE-2006-4160Multiple PHP remote file inclusion vulnerabilities in Tony B…
• CVE-2006-4161Directory traversal vulnerability in the avatar_gallery acti…
• CVE-2006-4162Cross-site scripting (XSS) vulnerability in Dragonfly CMS 9.…