CVE-2010-2358

PHP remote file inclusion vulnerability in modules/catalog/upload_photo.php in Nakid CMS 0.5.2, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the core[system_path] parameter. NOTE: some of these details are obtained from third party information.

• CWE-94

• http://packetstormsecurity.org/1006-exploits/nakid-rfi.txt
• http://secunia.com/advisories/40174Vendor Advisory
• http://www.exploit-db.com/exploits/13889Exploit
• http://www.securityfocus.com/bid/40882Exploit
• http://www.vupen.com/english/advisories/2010/1498Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/59453
• http://packetstormsecurity.org/1006-exploits/nakid-rfi.txt
• http://secunia.com/advisories/40174Vendor Advisory
• http://www.exploit-db.com/exploits/13889Exploit
• http://www.securityfocus.com/bid/40882Exploit
• http://www.vupen.com/english/advisories/2010/1498Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/59453

Published

Jun 21, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-2352The Node Reference module in Content Construction Kit (CCK) …
• CVE-2010-2353The Node Reference module in Content Construction Kit (CCK) …
• CVE-2010-2354SQL injection vulnerability in subscribe.php in Pilot Group …
• CVE-2010-2355Cross-site scripting (XSS) vulnerability in error.php in Pil…
• CVE-2010-2356Cross-site scripting (XSS) vulnerability in subscribe.php in…
• CVE-2010-2357SQL injection vulnerability in index.php in Eicra Realestate…
• CVE-2010-2359SQL injection vulnerability in eWebQuiz.asp in ActiveWebSoft…
• CVE-2010-2360Multiple buffer overflows in Winny 2.0b7.1 and earlier might…
• CVE-2010-2361Winny 2.0b7.1 and earlier does not properly process BBS info…
• CVE-2010-2362Winny 2.0b7.1 and earlier does not properly process node inf…
• CVE-2010-2363The IPv6 Unicast Reverse Path Forwarding (RPF) implementatio…
• CVE-2010-2364Cross-site scripting (XSS) vulnerability in Free CGI Moo moo…