What’s Vulnerable › Vulnerabilities
CVE-2009-2095
- Severity: medium (CVSS 6.8 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.7% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2009-06-17 · updated 2026-06-16
- Weakness: CWE-94
Description
PHP remote file inclusion vulnerability in template/simpledefault/admin/_masterlayout.php in Mundi Mail 0.8.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the top parameter. NOTE: when allow_url_fopen is disabled, directory traversal attacks are possible to include and execute arbitrary local files.
Affected products
- Mundi King Mundi Mail: 0.8.2
References
Get alerted when CVE-2009-2095 or the next vulnerability affects your stack