$ cve CVE-2006-2395 JSON

CVE-2006-2395 EXPLOIT

5.0

MEDIUM · CVSS 2.0 · EPSS 3.6% (pctl 89)

Patch early

A public exploit exists.

Description

PHP remote file inclusion vulnerability in resources/includes/popp.config.loader.inc.php in PopSoft Digital PopPhoto Studio 3.5.4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter (cfg['popphoto_base_path'] variable). NOTE: Pixaria has notified CVE that "PopPhoto is NOT a product of Pixaria. It was a product of PopSoft Digital and is only hosted by Pixaria as a courtesy... The vulnerability listed was patched by the previous vendor and all previous users have received this update."

Scoring

CVSS	5.0 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS	3.58% — more likely to be exploited than 89% of all CVEs
Weakness	CWE-94
On CISA KEV	no
Public exploit	yes
Published	2006-05-16
Last modified	2026-06-16

Affected (1)

Vendor	Product
popsoft digital	popphoto

Public exploits

Source	Title	Date
exploit-db	Pixaria PopPhoto 3.5.4 - 'CFG[popphoto_base_path]' Remote File Inclusion	2006-05-15

References

→ the Explorer · watch your stack · NVD