CVE-2006-4863

Multiple PHP remote file inclusion vulnerabilities in Marc Cagninacci mcLinksCounter 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the langfile parameter in (1) login.php, (2) stats.php, (3) detail.php, or (4) erase.php. NOTE: CVE and a third party dispute this vulnerability, because the langfile parameter is set to english.php in each file. NOTE: CVE also disputes a later report of this vulnerability in 1.2, because the langfile parameter is set to french.php in 1.2

• CWE-94

• http://marc.info/?l=bugtraq&m=115860241806867&w=2
• http://securityvulns.com/Rdocument844.html
• http://securityvulns.com/source26994.html
• http://www.securityfocus.com/archive/1/446062/100/0/threaded
• http://www.securityfocus.com/archive/1/477253/100/0/threaded
• http://www.securityfocus.com/archive/1/477363/100/0/threaded
• http://www.securityfocus.com/archive/1/482006/100/0/threaded
• http://marc.info/?l=bugtraq&m=115860241806867&w=2
• http://securityvulns.com/Rdocument844.html
• http://securityvulns.com/source26994.html
• http://www.securityfocus.com/archive/1/446062/100/0/threaded
• http://www.securityfocus.com/archive/1/477253/100/0/threaded
• http://www.securityfocus.com/archive/1/477363/100/0/threaded
• http://www.securityfocus.com/archive/1/482006/100/0/threaded

Published

Sep 19, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-4857SQL injection vulnerability in default.asp (aka the login pa…
• CVE-2006-4858PHP remote file inclusion vulnerability in install.serversta…
• CVE-2006-4859Unrestricted file upload vulnerability in contact.html.php i…
• CVE-2006-4860Multiple unspecified vulnerabilities in (1) index.php, (2) m…
• CVE-2006-4861SQL injection vulnerability in loginprocess.asp in Mohammed …
• CVE-2006-4862SQL injection vulnerability in default.aspx in easypage allo…
• CVE-2006-4864PHP remote file inclusion vulnerability in index.php in All …
• CVE-2006-4865Walter Beschmout PhpQuiz allows remote attackers to obtain s…
• CVE-2006-4866Buffer overflow in kextload in Apple OS X, as used by TDIXSu…
• CVE-2006-4867SQL injection vulnerability in mods.php in GNUTurk 2G and ea…
• CVE-2006-4868Stack-based buffer overflow in the Vector Graphics Rendering…
• CVE-2006-4869PHP remote file inclusion vulnerability in phpunity-postcard…