CVE-2006-6426

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-12-10 · updated 2026-06-16

Description

PHP remote file inclusion vulnerability in design/thinkedit/render.php in ThinkEdit 1.9.2 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the template_file parameter.

Affected products

Thinkedit: through 1.9.2

References

http://secunia.com/advisories/23279
http://securitytracker.com/id?1017359
http://svn.berlios.de/viewcvs/thinkedit/trunk/design/thinkedit/render.php?rev=321&r1=230&r2=321
http://www.vupen.com/english/advisories/2006/4906
https://exchange.xforce.ibmcloud.com/vulnerabilities/30772
https://www.exploit-db.com/exploits/2898
http://secunia.com/advisories/23279
http://securitytracker.com/id?1017359
http://svn.berlios.de/viewcvs/thinkedit/trunk/design/thinkedit/render.php?rev=321&r1=230&r2=321
http://www.vupen.com/english/advisories/2006/4906
https://exchange.xforce.ibmcloud.com/vulnerabilities/30772
https://www.exploit-db.com/exploits/2898

Get alerted when CVE-2006-6426 or the next vulnerability affects your stack