CVE-2006-4878

Directory traversal vulnerability in footer.php in David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote attackers to read and include arbitrary local files via a .. (dot dot) sequence in the template parameter. NOTE: this was later reported to affect 1.0.1, and demonstrated for code execution by uploading and accessing an avatar file.

• http://secunia.com/advisories/22014
• http://securityreason.com/securityalert/1607
• http://www.osvdb.org/28964
• http://www.securityfocus.com/archive/1/446318/100/0/threaded
• http://www.securityfocus.com/bid/20061
• http://www.securityfocus.com/bid/20616
• http://www.vupen.com/english/advisories/2006/3688
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29673
• https://www.exploit-db.com/exploits/2593
• http://secunia.com/advisories/22014
• http://securityreason.com/securityalert/1607
• http://www.osvdb.org/28964
• http://www.securityfocus.com/archive/1/446318/100/0/threaded
• http://www.securityfocus.com/bid/20061
• http://www.securityfocus.com/bid/20616
• http://www.vupen.com/english/advisories/2006/3688
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29673
• https://www.exploit-db.com/exploits/2593

Published

Sep 19, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-4872SQL injection vulnerability in search.asp in Keyvan1 (aka Ke…
• CVE-2006-4873Jupiter CMS allows remote attackers to obtain sensitive info…
• CVE-2006-4874Multiple cross-site scripting (XSS) vulnerabilities in Jupit…
• CVE-2006-4875Unrestricted file upload vulnerability in modules/galleryupl…
• CVE-2006-4876Multiple SQL injection vulnerabilities in Jupiter CMS allow …
• CVE-2006-4877Variable overwrite vulnerability in David Bennett PHP-Post (…
• CVE-2006-4879SQL injection vulnerability in profile.php in David Bennett …
• CVE-2006-4880David Bennett PHP-Post (PHPp) 1.0 and earlier allows remote …
• CVE-2006-4881Multiple cross-site scripting (XSS) vulnerabilities in David…
• CVE-2006-4882SQL injection vulnerability in Review.asp in Julian Roberts …
• CVE-2006-4883Multiple cross-site scripting (XSS) vulnerabilities in IDevS…
• CVE-2006-4884Multiple cross-site scripting (XSS) vulnerabilities in IDevS…