vulnwire
7.5high

CVE-2006-22952 exploits

Directory traversal vulnerability in Dynamic Galerie 1.0 allows remote attackers to access arbitrary files via an absolute path in the pfad…

Published 20 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
3.0%
percentile 87%
Public exploits
2
Exploit-DB

Directory traversal vulnerability in Dynamic Galerie 1.0 allows remote attackers to access arbitrary files via an absolute path in the pfad parameter to (1) index.php and (2) galerie.php.

Exploit prediction (EPSS)

2.96% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.

Exploits and detections

  • EDB-27839 timobraun Dynamic Galerie 1.0 - 'galerie.php?pfad' Arbitrary Directory Listing · webapps · 2006-05-08
  • EDB-27838 timobraun Dynamic Galerie 1.0 - 'index.php?pfad' Arbitrary Directory Listing · webapps · 2006-05-08

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

References

  • vupen.com /english/advisories/2006/1699 · vdb-entry, x_refsource_VUPEN, x_transferred
  • d4igoro.blogspot.com /2006/05/dynamic-galerie-10-path-traversal-xss.html · x_refsource_MISC, x_transferred
  • securityfocus.com /bid/17896 · vdb-entry, x_refsource_BID, x_transferred
  • secunia.com /advisories/19995 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/26322 · vdb-entry, x_refsource_XF, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.