← Vulnerability feed

Vulnerability record · CVE-2006-4477 · published 31 August 2006

CVE-2006-4477: Visualshapers ezcontents vulnerability

Visualshapers · Ezcontents

Multiple PHP remote file inclusion vulnerabilities in Visual Shapers ezContents 2.0.3 allow remote attackers to execute arbitrary PHP code via an empty GLOBALS[rootdp] parameter and an ftps URL in the (1) GLOBALS[admin_home] parameter in (a) diary/event_list.php, (b) gallery/gallery_summary.php, (c) guestbook/showguestbook.php, (d) links/showlinks.php, and (e) reviews/review_summary.php; and the (2) GLOBALS[language_home] parameter in (f) calendar/calendar.php, (g) news/shownews.php, (h) poll/showpoll.php, (i) search/search.php, (j) toprated/toprated.php, and (k) whatsnew/whatsnew.php.

7.5 CVSS 2.0 High EPSS 8.0% · top 5.4%
7.5CVSS 2.0 base score
8.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
36References, 26 tagged exploit
16 Jun 2026Last modified by NVD

Description

Multiple PHP remote file inclusion vulnerabilities in Visual Shapers ezContents 2.0.3 allow remote attackers to execute arbitrary PHP code via an empty GLOBALS[rootdp] parameter and an ftps URL in the (1) GLOBALS[admin_home] parameter in (a) diary/event_list.php, (b) gallery/gallery_summary.php, (c) guestbook/showguestbook.php, (d) links/showlinks.php, and (e) reviews/review_summary.php; and the (2) GLOBALS[language_home] parameter in (f) calendar/calendar.php, (g) news/shownews.php, (h) poll/showpoll.php, (i) search/search.php, (j) toprated/toprated.php, and (k) whatsnew/whatsnew.php.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/21703 ExploitVendor Advisory
http://securityreason.com/securityalert/1479
http://securitytracker.com/id?1016770
http://www.osvdb.org/28321 Exploit
http://www.osvdb.org/28322 Exploit
http://www.osvdb.org/28323 Exploit
http://www.osvdb.org/28324 Exploit
http://www.osvdb.org/28325 Exploit
http://www.osvdb.org/28326 Exploit
http://www.osvdb.org/28327 Exploit
http://www.osvdb.org/28328 Exploit
http://www.osvdb.org/28329 Exploit
http://www.osvdb.org/28330 Exploit
http://www.osvdb.org/28331 Exploit
http://www.securityfocus.com/archive/1/444779/100/0/threaded
http://www.securityfocus.com/bid/19776 Exploit
http://www.vupen.com/english/advisories/2006/3420
https://exchange.xforce.ibmcloud.com/vulnerabilities/28674
http://secunia.com/advisories/21703 ExploitVendor Advisory
http://securityreason.com/securityalert/1479
http://securitytracker.com/id?1016770
http://www.osvdb.org/28321 Exploit
http://www.osvdb.org/28322 Exploit
http://www.osvdb.org/28323 Exploit
http://www.osvdb.org/28324 Exploit
http://www.osvdb.org/28325 Exploit
http://www.osvdb.org/28326 Exploit
http://www.osvdb.org/28327 Exploit
http://www.osvdb.org/28328 Exploit
http://www.osvdb.org/28329 Exploit
http://www.osvdb.org/28330 Exploit
http://www.osvdb.org/28331 Exploit
http://www.securityfocus.com/archive/1/444779/100/0/threaded
http://www.securityfocus.com/bid/19776 Exploit
http://www.vupen.com/english/advisories/2006/3420
https://exchange.xforce.ibmcloud.com/vulnerabilities/28674

Track CVE-2006-4477 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2008-2135Visualshapers ezcontents sql injection vulnerabilityMultiple SQL injection vulnerabilities in VisualShapers ezContents 2.0.0 allow remote attackers to execute arbitrary SQL commands via the (1) content…EPSS 1.00%7.5CVE-2006-4478Visualshapers ezcontents vulnerabilitySQL injection vulnerability in headeruserdata.php in Visual Shapers ezContents 2.0.3 allows remote attackers to execute arbitrary SQL commands via th…EPSS 1.8%7.5CVE-2004-0132Visualshapers ezcontents vulnerabilityMultiple PHP remote file inclusion vulnerabilities in ezContents 2.0.2 and earlier allow remote attackers to execute arbitrary PHP code from a remote…EPSS 2.4%7.5CVE-2004-0070Visualshapers ezcontents vulnerabilityPHP remote file inclusion vulnerability in module.php for ezContents allows remote attackers to execute arbitrary PHP code by modifying the link para…EPSS 3.0%7.5CVE-2003-1214Visualshapers ezcontents vulnerabilityUnknown vulnerability in the server login for VisualShapers ezContents 2.02 and earlier allows remote attackers to bypass access restrictions and gai…EPSS 1.8%7.5CVE-2002-1085Visualshapers ezcontents vulnerabilityMultiple cross-site scripting vulnerabilities in ezContents 1.41 and earlier allow remote attackers to execute script and steal cookies via the diary…EPSS 2.5%7.5CVE-2002-1086Visualshapers ezcontents vulnerabilityMultiple SQL injection vulnerabilities in ezContents 1.41 and earlier allow remote attackers to conduct unauthorized activities.EPSS 1.9%6.4CVE-2002-1084Visualshapers ezcontents vulnerabilityThe VerifyLogin function in ezContents 1.41 and earlier does not properly halt program execution if a user fails to log in properly, which allows rem…EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2006-4477), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.