Description
Multiple directory traversal vulnerabilities in Page Engine CMS 2.0 Basic and Pro allow remote attackers to include and execute arbitrary local files via directory traversal sequences in the fPrefix parameter to (1) modules/recent_poll_include.php, (2) modules/login_include.php, and (3) modules/statistics_include.php and (4) configuration.inc.php in includes/. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
References (7)
Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/52178
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/52177
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/48856
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/52175
Third Party Advisory, VDB Entry vdb-entry
x_refsource_osvdb
http://osvdb.org/52176
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/33860
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33983
Scores
EPSS
0.0151
EPSS Percentile
71.4%
Details
CWE
CWE-22
Status
published
Products (1)
lingx/page_engine_cms
2.0 (2 CPE variants)
Published
Feb 24, 2009
Tracked Since
Feb 18, 2026