CVE-2006-4591
Last modified
CVE-2006-4591 is a vulnerability of currently unknown severity. Multiple PHP remote file inclusion vulnerabilities in AlstraSoft Template Seller, and possibly AltraSoft Template Seller Pro 3.25, allow remote attackers to execute arbitrary PHP code via a URL in the config[template_path] parameter to (1) payment/payment_result.php or (2) /payment/spuser_result.php.. EPSS estimates a 2.47% chance of exploitation in the next 30 days.
Description
Multiple PHP remote file inclusion vulnerabilities in AlstraSoft Template Seller, and possibly AltraSoft Template Seller Pro 3.25, allow remote attackers to execute arbitrary PHP code via a URL in the config[template_path] parameter to (1) payment/payment_result.php or (2) /payment/spuser_result.php.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Alstrasoft | Template Seller | All versions |
| Alstrasoft | Template Seller | 3.25 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2006-4591?
How severe is CVE-2006-4591?
How do I fix CVE-2006-4591?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2006
- CVE-2006-4585SQL injection vulnerability in admin/editer.php in Tr Forum …
- CVE-2006-4586The admin panel in Tr Forum 2.0 accepts a username and passw…
- CVE-2006-4587Multiple cross-site scripting (XSS) vulnerabilities in vtige…
- CVE-2006-4588vtiger CRM 4.2.4, and possibly earlier, allows remote attack…
- CVE-2006-4589PHP remote file inclusion vulnerability in 0_admin/modules/W…
- CVE-2006-4590SQL injection vulnerability in admin/default.asp in Jetstat.…
- CVE-2006-4592Incomplete blacklist vulnerability in default.asp in 8pixel.…
- CVE-2006-4593Cross-site scripting (XSS) vulnerability in index.php in Sof…
- CVE-2006-4594Multiple PHP remote file inclusion vulnerabilities in PHP Ad…
- CVE-2006-4595muforum (µforum) 0.4c stores membres/members.dat under the w…
- CVE-2006-4596PHP remote file inclusion in MyBace Light Skrip, when regist…
- CVE-2006-4597SQL injection vulnerability in devam.asp in ICBlogger 2.0 an…
Are you affected by CVE-2006-4591?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST