CVE-2006-4559

Multiple PHP remote file inclusion vulnerabilities in Yet Another Community System (YACS) CMS 6.6.1 allow remote attackers to execute arbitrary PHP code via a URL in the context[path_to_root] parameter in (1) articles/populate.php, (2) categories/category.php, (3) categories/populate.php, (4) comments/populate.php, (5) files/file.php, (6) sections/section.php, (7) sections/populate.php, (8) tables/populate.php, (9) users/user.php, and (10) users/populate.php. The articles/article.php vector is covered by CVE-2006-4532.

• http://secunia.com/advisories/21680Exploit, Patch, Vendor Advisory
• http://www.osvdb.org/31301
• http://www.osvdb.org/31302
• http://www.osvdb.org/31303
• http://www.osvdb.org/31304
• http://www.osvdb.org/31305
• http://www.osvdb.org/31306
• http://www.osvdb.org/31307
• http://www.osvdb.org/31308
• http://www.osvdb.org/31309
• http://www.osvdb.org/31310
• http://www.yetanothercommunitysystem.com/yacs/articles/view.php/1664Patch, URL Repurposed
• http://secunia.com/advisories/21680Exploit, Patch, Vendor Advisory
• http://www.osvdb.org/31301
• http://www.osvdb.org/31302
• http://www.osvdb.org/31303
• http://www.osvdb.org/31304
• http://www.osvdb.org/31305
• http://www.osvdb.org/31306
• http://www.osvdb.org/31307
• http://www.osvdb.org/31308
• http://www.osvdb.org/31309
• http://www.osvdb.org/31310
• http://www.yetanothercommunitysystem.com/yacs/articles/view.php/1664Patch, URL Repurposed

Published

Sep 6, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-4553PHP remote file inclusion vulnerability in plugin.class.php …
• CVE-2006-4554Stack-based buffer overflow in the ReadFile function in the …
• CVE-2006-4555Buffer overflow in the Retro64 / Miniclip CR64Loader ActiveX…
• CVE-2006-4556PHP remote file inclusion vulnerability in index.php in the …
• CVE-2006-4557PHP remote file inclusion vulnerability in plugins/plugins.p…
• CVE-2006-4558DeluxeBB 1.06 and earlier, when run on the Apache HTTP Serve…
• CVE-2006-4560Internet Explorer 6 on Windows XP SP2 allows remote attacker…
• CVE-2006-4561Mozilla Firefox 1.5.0.6 allows remote attackers to execute a…
• CVE-2006-4562The proxy DNS service in Symantec Gateway Security (SGS) all…
• CVE-2006-4563Cross-site scripting (XSS) vulnerability in the MyHeadlines …
• CVE-2006-4564SQL injection vulnerability in Sources/ManageBoards.php in S…
• CVE-2006-4565Heap-based buffer overflow in Mozilla Firefox before 1.5.0.7…