What’s Vulnerable › Vulnerabilities

CVE-2008-1866

• Severity: critical (CVSS 9.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2008-04-17 · updated 2026-06-16
• Weakness: CWE-94

Description

admin/modif_config.php in Blog Pixel Motion (aka PixelMotion) does not require admin authentication, which allows remote authenticated users to upload arbitrary PHP scripts in a ZIP archive, which is written to templateZip/ and then automatically extracted under templates/ for execution via a direct request.

Affected products

• Pixel Motion Blog: all versions

References

• http://www.securityfocus.com/bid/28646
• http://www.vupen.com/english/advisories/2008/1121/references
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41670
• https://www.exploit-db.com/exploits/5381
• http://www.securityfocus.com/bid/28646
• http://www.vupen.com/english/advisories/2008/1121/references
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41670
• https://www.exploit-db.com/exploits/5381

Get alerted when CVE-2008-1866 or the next vulnerability affects your stack