Multiple incomplete blacklist vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitrary PHP code via a U…

Published 19 y ago 2007-09-24 · modified 4 mo ago 2026-06-16 · JSON

CVSS

7.5

v2.0 · NVD

CISA KEV

not known exploited

EPSS

2.2%

percentile 82%

Public exploits

Exploit-DB

Multiple incomplete blacklist vulnerabilities in iziContents 1 RC6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in (1) the admin_home parameter to modules/poll/poll_summary.php or (2) the rootdp parameter to include/db.php; or a URL in the language_home parameter to (3) search/search.php, (4) poll/inlinepoll.php, (5) poll/showpoll.php, (6) links/showlinks.php, or (7) links/submit_links.php in modules/; related to missing checks in (a) modules/moduleSec.php and (b) include/includeSec.php for inclusion of certain URLs, as demonstrated by an ftps:// URL.

Exploit prediction (EPSS)

2.16% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.

Exploits and detections

EDB-4441 iziContents rc6 - Local/Remote File Inclusion · webapps · 2007-09-21

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

exploit-db.com /exploits/4441 · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

CVE List: CVE-2007-5053
NVD: CVE-2007-5053

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.