CVE-2006-1746

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-04-12 · updated 2026-06-16
Weakness: CWE-22

Description

Directory traversal vulnerability in PHPList 2.10.2 and earlier allows remote attackers to include arbitrary local files via the (1) GLOBALS[database_module] or (2) GLOBALS[language_module] parameters, which overwrite the underlying $GLOBALS variable.

Affected products

Tincan Phplist: through 2.10.2; 2.6, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5 (+6)

References

http://downloads.securityfocus.com/vulnerabilities/exploits/PHPList-lfi.php
http://securitytracker.com/id?1015889
http://tincan.co.uk/?lid=851
http://www.securityfocus.com/archive/1/430475/30/30/threaded
http://www.securityfocus.com/archive/1/430597
http://www.securityfocus.com/archive/1/448411
http://www.securityfocus.com/bid/17429
http://www.vupen.com/english/advisories/2006/1296
https://exchange.xforce.ibmcloud.com/vulnerabilities/25701
http://downloads.securityfocus.com/vulnerabilities/exploits/PHPList-lfi.php
http://securitytracker.com/id?1015889
http://tincan.co.uk/?lid=851

Get alerted when CVE-2006-1746 or the next vulnerability affects your stack