Description
Multiple PHP remote file inclusion vulnerabilities in the Newbb Plus (newbb_plus) module 0.93 in RunCMS 1.6.1 allow remote attackers to execute arbitrary PHP code via a URL in the (1) bbPath[path] parameter to votepolls.php and the (2) bbPath[root_theme] parameter to config.php, different vectors than CVE-2006-0659. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploits (2)
References (3)
Core 3
Core References
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/30331
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/43969
Exploit x_refsource_misc
http://www.securityfocus.com/bid/30331/exploit
Scores
EPSS
0.0088
EPSS Percentile
75.5%
Details
CWE
CWE-94
Status
published
Products (2)
runcms/newbb_plus_module
0.93
runcms/runcms
1.6.1
Published
Jul 28, 2008
Tracked Since
Feb 18, 2026