CVE-2006-4477

Multiple PHP remote file inclusion vulnerabilities in Visual Shapers ezContents 2.0.3 allow remote attackers to execute arbitrary PHP code via an empty GLOBALS[rootdp] parameter and an ftps URL in the (1) GLOBALS[admin_home] parameter in (a) diary/event_list.php, (b) gallery/gallery_summary.php, (c) guestbook/showguestbook.php, (d) links/showlinks.php, and (e) reviews/review_summary.php; and the (2) GLOBALS[language_home] parameter in (f) calendar/calendar.php, (g) news/shownews.php, (h) poll/showpoll.php, (i) search/search.php, (j) toprated/toprated.php, and (k) whatsnew/whatsnew.php.

• http://secunia.com/advisories/21703Exploit, Vendor Advisory
• http://securityreason.com/securityalert/1479
• http://securitytracker.com/id?1016770
• http://www.osvdb.org/28321Exploit
• http://www.osvdb.org/28322Exploit
• http://www.osvdb.org/28323Exploit
• http://www.osvdb.org/28324Exploit
• http://www.osvdb.org/28325Exploit
• http://www.osvdb.org/28326Exploit
• http://www.osvdb.org/28327Exploit
• http://www.osvdb.org/28328Exploit
• http://www.osvdb.org/28329Exploit
• http://www.osvdb.org/28330Exploit
• http://www.osvdb.org/28331Exploit
• http://www.securityfocus.com/archive/1/444779/100/0/threaded
• http://www.securityfocus.com/bid/19776Exploit
• http://www.vupen.com/english/advisories/2006/3420
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28674
• http://secunia.com/advisories/21703Exploit, Vendor Advisory
• http://securityreason.com/securityalert/1479
• http://securitytracker.com/id?1016770
• http://www.osvdb.org/28321Exploit
• http://www.osvdb.org/28322Exploit
• http://www.osvdb.org/28323Exploit
• http://www.osvdb.org/28324Exploit
• http://www.osvdb.org/28325Exploit
• http://www.osvdb.org/28326Exploit
• http://www.osvdb.org/28327Exploit
• http://www.osvdb.org/28328Exploit
• http://www.osvdb.org/28329Exploit
• http://www.osvdb.org/28330Exploit
• http://www.osvdb.org/28331Exploit
• http://www.securityfocus.com/archive/1/444779/100/0/threaded
• http://www.securityfocus.com/bid/19776Exploit
• http://www.vupen.com/english/advisories/2006/3420
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28674

Published

Aug 31, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-4471The Admin Upload Image functionality in Joomla! before 1.0.1…
• CVE-2006-4472Multiple unspecified vulnerabilities in Joomla! before 1.0.1…
• CVE-2006-4473Unspecified vulnerability in com_content in Joomla! before 1…
• CVE-2006-4474Multiple cross-site scripting (XSS) vulnerabilities in Jooml…
• CVE-2006-4475Joomla! before 1.0.11 does not limit access to the Admin Pop…
• CVE-2006-4476Multiple unspecified vulnerabilities in Joomla! before 1.0.1…
• CVE-2006-4478SQL injection vulnerability in headeruserdata.php in Visual …
• CVE-2006-4479Cross-site scripting (XSS) vulnerability in loginreq2.php in…
• CVE-2006-4480Incomplete blacklist vulnerability in the nk_CSS function in…
• CVE-2006-4481The (1) file_exists and (2) imap_reopen functions in PHP bef…
• CVE-2006-4482Multiple heap-based buffer overflows in the (1) str_repeat a…
• CVE-2006-4483The cURL extension files (1) ext/curl/interface.c and (2) ex…