CVE-2006-6957

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-01-29 · updated 2026-06-16
Weakness: CWE-94

Description

PHP remote file inclusion vulnerability in addons/mod_media/body.php in Docebo 3.0.3 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[where_framework] parameter. NOTE: this issue might be resultant from a global overwrite vulnerability. This issue is similar to CVE-2006-2576 and CVE-2006-3107, but the vectors are different.

Affected products

Docebo: through 3.0.3

References

http://archives.neohapsis.com/archives/bugtraq/2006-06/0109.html
http://securityreason.com/securityalert/2194
http://www.osvdb.org/26710
http://archives.neohapsis.com/archives/bugtraq/2006-06/0109.html
http://securityreason.com/securityalert/2194
http://www.osvdb.org/26710

Get alerted when CVE-2006-6957 or the next vulnerability affects your stack