$ cve CVE-2007-5642 JSON

CVE-2007-5642 EXPLOIT

6.8

MEDIUM · CVSS 2.0 · EPSS 6.2% (pctl 93)

Patch early

A public exploit exists.

Description

Multiple directory traversal vulnerabilities in PHP Project Management 0.8.10 and earlier allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the def_lang parameter to modules/files/list.php; the m_path parameter to (2) modules/projects/summary.inc.php or (3) modules/tasks/summary.inc.php; (4) the module parameter to modules/projects/list.php; or the module parameter to index.php in the (5) certinfo, (6) emails, (7) events, (8) fax, (9) files, (10) groupadm, (11) history, (12) info, (13) log, (14) mail, (15) messages, (16) organizations, (17) phones, (18) presence, (19) projects, (20) reports, (21) search, (22) snf, (23) syslog, (24) tasks, or (25) useradm subdirectory of modules/.

Scoring

CVSS	6.8 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS	6.22% — more likely to be exploited than 93% of all CVEs
Weakness	CWE-22
On CISA KEV	no
Public exploit	yes
Published	2007-10-23
Last modified	2026-06-16

Affected (1)

Vendor	Product
phppm	php project management

Public exploits

Source	Title	Date
exploit-db	PHP Project Management 0.8.10 - Multiple Local/Remote File Inclusions	2007-10-21