← Vulnerability feed

Vulnerability record · CVE-2006-1477 · published 29 March 2006

CVE-2006-1477: Turnkey web tools php live helper vulnerability

Turnkey Web Tools · Php Live Helper

Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Live Helper 1.8 allow remote attackers to include and execute arbitrary PHP code via the abs_path parameter in (1) initiate.php, (2) waiting.php, (3) welcome.php, (4) admin/index.php, (5) javascript.php, (6) checkchat.php, and (7) blank.php.

7.5 CVSS 2.0 High EPSS 4.8% · top 8.4%
7.5CVSS 2.0 base score
4.8%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
32References, 4 tagged exploit
16 Jun 2026Last modified by NVD

Description

Multiple PHP remote file inclusion vulnerabilities in Turnkey Web Tools PHP Live Helper 1.8 allow remote attackers to include and execute arbitrary PHP code via the abs_path parameter in (1) initiate.php, (2) waiting.php, (3) welcome.php, (4) admin/index.php, (5) javascript.php, (6) checkchat.php, and (7) blank.php.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/19428 ExploitVendor Advisory
http://www.osvdb.org/24193
http://www.osvdb.org/24194
http://www.osvdb.org/24195
http://www.osvdb.org/24196
http://www.osvdb.org/24197
http://www.osvdb.org/24198
http://www.osvdb.org/24199
http://www.securityfocus.com/archive/1/428976/100/0/threaded
http://www.securityfocus.com/archive/1/437648/100/0/threaded
http://www.securityfocus.com/archive/1/437741/100/0/threaded
http://www.securityfocus.com/bid/18509
http://www.turnkeywebtools.com/forum/showthread.php?p=10415 Patch
http://www.vupen.com/english/advisories/2006/1137
http://www.worlddefacers.de/Public/WD-TMPLH.txt Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/25489
http://secunia.com/advisories/19428 ExploitVendor Advisory
http://www.osvdb.org/24193
http://www.osvdb.org/24194
http://www.osvdb.org/24195
http://www.osvdb.org/24196
http://www.osvdb.org/24197
http://www.osvdb.org/24198
http://www.osvdb.org/24199
http://www.securityfocus.com/archive/1/428976/100/0/threaded
http://www.securityfocus.com/archive/1/437648/100/0/threaded
http://www.securityfocus.com/archive/1/437741/100/0/threaded
http://www.securityfocus.com/bid/18509
http://www.turnkeywebtools.com/forum/showthread.php?p=10415 Patch
http://www.vupen.com/english/advisories/2006/1137
http://www.worlddefacers.de/Public/WD-TMPLH.txt Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/25489

Track CVE-2006-1477 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2006-4051Turnkey web tools php live helper vulnerabilityPHP remote file inclusion vulnerability in global.php in Turnkey Web Tools PHP Live Helper 2.0 and earlier allows remote attackers to execute arbitra…EPSS 8.3%7.5CVE-2006-1478Turnkey web tools php live helper vulnerabilityDirectory traversal vulnerability in (1) initiate.php and (2) possibly other PHP scripts in Turnkey Web Tools PHP Live Helper 1.8, and possibly later…EPSS 2.0%5.8CVE-2006-2394Turnkey web tools php live helper vulnerabilityCross-site scripting (XSS) vulnerability in chat.php in PHP Live Helper allows remote attackers to inject arbitrary web script or HTML via the PHPSES…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2006-1477), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.