CVE-2006-7070

Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier allows remote attackers to upload and execute arbitrary files via an nfile[] parameter with a filename that contains a .php extension followed by a valid image extension such as .gif or .jpg, then calling the rename function.

• CWE-20

• http://retrogod.altervista.org/etomite_061_cmd.htmlExploit
• http://secunia.com/advisories/21208Patch, Vendor Advisory
• http://securityreason.com/securityalert/2326
• http://securitytracker.com/id?1016593Vendor Advisory
• http://www.etomite.org/forums/index.php?showtopic=5757&st=0&p=35605&#entry35605Patch
• http://www.osvdb.org/27543
• http://www.securityfocus.com/archive/1/441202/100/0/threaded
• http://www.securityfocus.com/bid/19157Exploit, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27947
• https://www.exploit-db.com/exploits/2072
• http://retrogod.altervista.org/etomite_061_cmd.htmlExploit
• http://secunia.com/advisories/21208Patch, Vendor Advisory
• http://securityreason.com/securityalert/2326
• http://securitytracker.com/id?1016593Vendor Advisory
• http://www.etomite.org/forums/index.php?showtopic=5757&st=0&p=35605&#entry35605Patch
• http://www.osvdb.org/27543
• http://www.securityfocus.com/archive/1/441202/100/0/threaded
• http://www.securityfocus.com/bid/19157Exploit, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27947
• https://www.exploit-db.com/exploits/2072

Published

Mar 2, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-7064Cross-site scripting (XSS) vulnerability in forum/admin.php …
• CVE-2006-7065Microsoft Internet Explorer allows remote attackers to cause…
• CVE-2006-7066Microsoft Internet Explorer 6 on Windows XP SP2 allows remot…
• CVE-2006-7067Oracle 10g R2 and possibly other versions allows remote atta…
• CVE-2006-7068PHP remote file inclusion vulnerability in CliServ Web Commu…
• CVE-2006-7069PHP remote file inclusion vulnerability in smarty_config.php…
• CVE-2006-7071SQL injection vulnerability in classes/class_session.php in …
• CVE-2006-7072Cross-site scripting (XSS) vulnerability in GeoClassifieds E…
• CVE-2006-7073Cross-site scripting (XSS) vulnerability in Opentools Attach…
• CVE-2006-7074admin.php in SmartSiteCMS 1.0 allows remote attackers to byp…
• CVE-2006-7075Buffer overflow in the meta_read_flac function in meta_decod…
• CVE-2006-7076Cross-site scripting (XSS) vulnerability in guestbook.php in…