CVE-2007-5389

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-10-12 · updated 2026-06-16
Weakness: CWE-94

Description

PHP remote file inclusion vulnerability in preview.php in the swMenuFree (com_swmenufree) 4.6 component for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: a reliable third party disputes this issue because preview.php tests a certain constant to prevent direct requests

Affected products

Joomla! Joomla: all versions
Swmenupro Swmenufree: 4.6

References

http://osvdb.org/37903
http://securityreason.com/securityalert/3210
http://www.attrition.org/pipermail/vim/2007-October/001825.html
http://www.securityfocus.com/archive/1/482100/100/0/threaded
http://www.securityfocus.com/archive/1/482165/100/0/threaded
http://osvdb.org/37903
http://securityreason.com/securityalert/3210
http://www.attrition.org/pipermail/vim/2007-October/001825.html
http://www.securityfocus.com/archive/1/482100/100/0/threaded
http://www.securityfocus.com/archive/1/482165/100/0/threaded

Get alerted when CVE-2007-5389 or the next vulnerability affects your stack