CVE-2006-4602

Unrestricted file upload vulnerability in jhot.php in TikiWiki 1.9.4 Sirius and earlier allows remote attackers to execute arbitrary PHP code via a filepath parameter that contains a filename with a .php extension, which is uploaded to the img/wiki/ directory.

• http://isc.sans.org/diary.php?storyid=1672
• http://secunia.com/advisories/21733Vendor Advisory
• http://secunia.com/advisories/22100Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200609-16.xml
• http://tikiwiki.org/tiki-read_article.php?articleId=136
• http://www.osvdb.org/28456
• http://www.securityfocus.com/bid/19819Exploit
• http://www.vupen.com/english/advisories/2006/3450Vendor Advisory
• https://www.exploit-db.com/exploits/2288
• http://isc.sans.org/diary.php?storyid=1672
• http://secunia.com/advisories/21733Vendor Advisory
• http://secunia.com/advisories/22100Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200609-16.xml
• http://tikiwiki.org/tiki-read_article.php?articleId=136
• http://www.osvdb.org/28456
• http://www.securityfocus.com/bid/19819Exploit
• http://www.vupen.com/english/advisories/2006/3450Vendor Advisory
• https://www.exploit-db.com/exploits/2288

Published

Sep 7, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-4596PHP remote file inclusion in MyBace Light Skrip, when regist…
• CVE-2006-4597SQL injection vulnerability in devam.asp in ICBlogger 2.0 an…
• CVE-2006-4598Multiple SQL injection vulnerabilities in links.php in ssLin…
• CVE-2006-4599SQL injection vulnerability in aut_verifica.inc.php in Auten…
• CVE-2006-4600slapd in OpenLDAP before 2.3.25 allows remote authenticated …
• CVE-2006-4601SQL injection vulnerability in index.php in Annuaire 1Two 2.…
• CVE-2006-4603NCH Swift Sound Web Dictate 1.02 allows remote attackers to …
• CVE-2006-4604PHP remote file inclusion vulnerability in LFXlib/access_man…
• CVE-2006-4605PHP remote file inclusion vulnerability in index.php in Long…
• CVE-2006-4606Multiple SQL injection vulnerabilities in Longino Jacome php…
• CVE-2006-4607admin/index.php in Longino Jacome php-Revista 1.1.2 allows r…
• CVE-2006-4608Multiple cross-site scripting (XSS) vulnerabilities in Longi…