$ cve CVE-2006-2877 JSON

CVE-2006-2877 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 7.6% (pctl 94)

Patch early

A public exploit exists.

Description

PHP remote file inclusion vulnerability in Bookmark4U 2.0.0 and earlier allows remote attackers to include arbitrary PHP files via the include_prefix parameter in (1) inc/dbase.php, (2) inc/config.php, (3) inc/common.php, and (4) inc/function.php. NOTE: it has been reported that the inc directory is protected by a .htaccess file, so this issue only applies in certain environments or configurations.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	7.61% — more likely to be exploited than 94% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2006-06-07
Last modified	2026-06-16

Affected (1)

Vendor	Product
sangwan kim	bookmark4u

Public exploits

Source	Title	Date
exploit-db	Bookmark4U 2.0 - '/inc/dbase.php?env[include_prefix]' Remote File Inclusion	2006-06-05
exploit-db	Bookmark4U 2.0 - '/inc/config.php?env[include_prefix]' Remote File Inclusion	2006-06-05
exploit-db	Bookmark4U 2.0 - '/inc/common.php?env[include_prefix]' Remote File Inclusion	2006-06-05
exploit-db	Bookmark4U 2.0 - '/inc/function.php?env[include_prefix]' Remote File Inclusion	2006-06-05

References

→ the Explorer · watch your stack · NVD