Absolute path traversal vulnerability in blanko.preview.php in Sisfo Kampus 2006 allows remote attackers to read arbitrary local files, and…

Published 19 y ago 2007-09-11 · modified 4 mo ago 2026-06-16 · JSON

CVSS

7.5

v2.0 · NVD

CISA KEV

not known exploited

EPSS

2.3%

percentile 84%

Public exploits

Exploit-DB

Absolute path traversal vulnerability in blanko.preview.php in Sisfo Kampus 2006 allows remote attackers to read arbitrary local files, and possibly execute local PHP scripts, via the nmf parameter.

Exploit prediction (EPSS)

2.33% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.

Exploits and detections

EDB-4380 Sisfo Kampus 2006 - 'blanko.preview.php' Local File Disclosure · webapps · 2007-09-08

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

securityfocus.com /bid/25605 · vdb-entry, x_refsource_BID, x_transferred
osvdb.org /39017 · vdb-entry, x_refsource_OSVDB, x_transferred
exploit-db.com /exploits/4380 · exploit, x_refsource_EXPLOIT-DB, x_transferred
exchange.xforce.ibmcloud.com /vulnerabilities/36533 · vdb-entry, x_refsource_XF, x_transferred

Sources

CVE List: CVE-2007-4820
NVD: CVE-2007-4820

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.