CVE-2006-2686

Public Exploit

Description

PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[AA_INC_PATH] parameter in (1) cached.php3, (2) cron.php3, (3) discussion.php3, (4) filldisc.php3, (5) filler.php3, (6) fillform.php3, (7) go.php3, (8) hiercons.php3, (9) jsview.php3, (10) live_checkbox.php3, (11) offline.php3, (12) post2shtml.php3, (13) search.php3, (14) slice.php3, (15) sql_update.php3, (16) view.php3, (17) multiple files in the (18) admin/ folder, (19) includes folder, and (20) modules/ folder.

Category

6.4
CVSS
Severity: Medium
CVSS 2.0 •
EPSS 11.58% Top 10%
Vendor Advisory secunia.com
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
http://www.osvdb.org/27308 vdb entry
http://www.osvdb.org/27289 vdb entry
http://www.osvdb.org/27304 vdb entry
http://www.osvdb.org/27269 vdb entry
http://www.osvdb.org/27256 vdb entry
https://www.exploit-db.com/exploits/1829 exploit
http://www.osvdb.org/27275 vdb entry
http://www.osvdb.org/27270 vdb entry
http://www.osvdb.org/27292 vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/26776 vdb entry
http://www.vupen.com/english/advisories/2006/1997 vdb entry
http://www.osvdb.org/27305 vdb entry
http://www.osvdb.org/27272 vdb entry
http://www.osvdb.org/27278 vdb entry
http://www.osvdb.org/27294 vdb entry
http://www.osvdb.org/27273 vdb entry
http://www.osvdb.org/27287 vdb entry
http://www.osvdb.org/27274 vdb entry
http://www.osvdb.org/27284 vdb entry
http://www.osvdb.org/27253 vdb entry
http://www.osvdb.org/27276 vdb entry
http://www.osvdb.org/27306 vdb entry
http://www.osvdb.org/27263 vdb entry
http://www.osvdb.org/27298 vdb entry
http://www.osvdb.org/27295 vdb entry
http://www.osvdb.org/27271 vdb entry
http://www.osvdb.org/27288 vdb entry
http://www.osvdb.org/27310 vdb entry
http://www.osvdb.org/27264 vdb entry
http://www.osvdb.org/27262 vdb entry
http://www.osvdb.org/27257 vdb entry
http://www.osvdb.org/27259 vdb entry
http://www.osvdb.org/27280 vdb entry
http://secunia.com/advisories/20299 exploit third party advisory vendor advisory
http://www.osvdb.org/27309 vdb entry
http://www.osvdb.org/27291 vdb entry
http://www.osvdb.org/27267 vdb entry
http://www.osvdb.org/27281 vdb entry
http://www.osvdb.org/27282 vdb entry
http://www.osvdb.org/27301 vdb entry
http://www.osvdb.org/27254 vdb entry
http://www.osvdb.org/27268 vdb entry
http://www.osvdb.org/27258 vdb entry
http://www.osvdb.org/27299 vdb entry
http://www.osvdb.org/27300 vdb entry
http://www.osvdb.org/27297 vdb entry
http://www.osvdb.org/27285 vdb entry
http://www.osvdb.org/27286 vdb entry
http://www.osvdb.org/27296 vdb entry
http://www.osvdb.org/27303 vdb entry
http://www.osvdb.org/27279 vdb entry
http://www.osvdb.org/27277 vdb entry
http://www.securityfocus.com/bid/19133 vdb entry
http://www.osvdb.org/27283 vdb entry
http://www.osvdb.org/27261 vdb entry
http://www.osvdb.org/27302 vdb entry
http://www.osvdb.org/27260 vdb entry
http://www.osvdb.org/27266 vdb entry
http://www.osvdb.org/27290 vdb entry
http://www.osvdb.org/27293 vdb entry
http://www.osvdb.org/27265 vdb entry

Frequently Asked Questions

What is the severity of CVE-2006-2686?
CVE-2006-2686 has been scored as a medium severity vulnerability.
How to fix CVE-2006-2686?
To fix CVE-2006-2686, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2006-2686 being actively exploited in the wild?
It is possible that CVE-2006-2686 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~12% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.