CVE-2007-4328

Multiple PHP remote file inclusion vulnerabilities in Mapos Bilder Galerie 1.0 allow remote attackers to execute arbitrary PHP code via a URL in the config[root_ordner] parameter to (1) index.php, (2) galerie.php, or (3) anzagien.php. NOTE: A later report states that 1.1 is also affected, but that the filename for vector 3 is anzeigen.php.

• CWE-94

• http://osvdb.org/36455
• http://osvdb.org/36456
• http://osvdb.org/36457
• http://secunia.com/advisories/26400Vendor Advisory
• http://securityreason.com/securityalert/2999
• http://www.securityfocus.com/archive/1/475952/100/0/threaded
• http://www.securityfocus.com/bid/25256Exploit
• http://www.vupen.com/english/advisories/2007/2838Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35923
• http://osvdb.org/36455
• http://osvdb.org/36456
• http://osvdb.org/36457
• http://secunia.com/advisories/26400Vendor Advisory
• http://securityreason.com/securityalert/2999
• http://www.securityfocus.com/archive/1/475952/100/0/threaded
• http://www.securityfocus.com/bid/25256Exploit
• http://www.vupen.com/english/advisories/2007/2838Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35923

Published

Aug 14, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-4322BlockHosts before 2.0.4 does not properly parse (1) sshd and…
• CVE-2007-4323DenyHosts 2.6 does not properly parse sshd log files, which …
• CVE-2007-4324ActionScript 3 (AS3) in Adobe Flash Player 9.0.47.0, and oth…
• CVE-2007-4325PHP remote file inclusion vulnerability in index.php in Gaes…
• CVE-2007-4326Multiple PHP remote file inclusion vulnerabilities in Bilder…
• CVE-2007-4327Multiple PHP remote file inclusion vulnerabilities in File U…
• CVE-2007-4329Multiple PHP remote file inclusion vulnerabilities in Web Ne…
• CVE-2007-4330PHP remote file inclusion vulnerability in shoutbox.php in S…
• CVE-2007-4331PHP remote file inclusion vulnerability in index.php in Find…
• CVE-2007-4332SQL injection vulnerability in article.php in Article Dashbo…
• CVE-2007-4333Multiple cross-site scripting (XSS) vulnerabilities in signu…
• CVE-2007-4334Cross-site scripting (XSS) vulnerability in whois.php in Php…