$ cve CVE-2006-2864 JSON

CVE-2006-2864 EXPLOIT

5.1

MEDIUM · CVSS 2.0 · EPSS 15.6% (pctl 97)

Patch early

A public exploit exists.

Description

Multiple PHP remote file inclusion vulnerabilities in BlueShoes Framework 4.6 allow remote attackers to execute arbitrary PHP code via a URL in the (1) APP[path][applications] parameter to (a) Bs_Faq.class.php, (2) APP[path][core] parameter to (b) fileBrowserInner.php, (c) file.php, and (d) viewer.php, and (e) Bs_ImageArchive.class.php, (3) GLOBALS[APP][path][core] parameter to (f) Bs_Ml_User.class.php, or (4) APP[path][plugins] parameter to (g) Bs_Wse_Profile.class.php.

Scoring

CVSS	5.1 (MEDIUM, v2.0)
Vector	AV:N/AC:H/Au:N/C:P/I:P/A:P
EPSS	15.6% — more likely to be exploited than 97% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-06-06
Last modified	2026-06-16

Affected (1)

Vendor	Product
blueshoes	blueshoes framework

Public exploits

Source	Title	Date
exploit-db	BlueShoes Framework 4.6 - Remote File Inclusion	2006-06-03

References

→ the Explorer · watch your stack · NVD