← Vulnerability feed

Vulnerability record · CVE-2006-7070 · published 2 March 2007

CVE-2006-7070: Etomite improper input validation vulnerability

Etomite · Etomite

Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier allows remote attackers to upload and execute arbitrary files via an nfile[] parameter with a filename that contains a .php extension followed by a valid image extension such as .gif or .jpg, then calling the rename function.

7.5 CVSS 2.0 High EPSS 4.0% · top 9.8% CWE-20 · Improper input validation
7.5CVSS 2.0 base score
4.0%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
20References, 4 tagged exploit
16 Jun 2026Last modified by NVD

Description

Unrestricted file upload vulnerability in manager/media/ibrowser/scripts/rfiles.php in Etomite CMS 0.6.1 and earlier allows remote attackers to upload and execute arbitrary files via an nfile[] parameter with a filename that contains a .php extension followed by a valid image extension such as .gif or .jpg, then calling the rename function.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://retrogod.altervista.org/etomite_061_cmd.html Exploit
http://secunia.com/advisories/21208 PatchVendor Advisory
http://securityreason.com/securityalert/2326
http://securitytracker.com/id?1016593 Vendor Advisory
http://www.etomite.org/forums/index.php?showtopic=5757&st=0&p=35605&#entry35605 Patch
http://www.osvdb.org/27543
http://www.securityfocus.com/archive/1/441202/100/0/threaded
http://www.securityfocus.com/bid/19157 ExploitVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27947
https://www.exploit-db.com/exploits/2072
http://retrogod.altervista.org/etomite_061_cmd.html Exploit
http://secunia.com/advisories/21208 PatchVendor Advisory
http://securityreason.com/securityalert/2326
http://securitytracker.com/id?1016593 Vendor Advisory
http://www.etomite.org/forums/index.php?showtopic=5757&st=0&p=35605&#entry35605 Patch
http://www.osvdb.org/27543
http://www.securityfocus.com/archive/1/441202/100/0/threaded
http://www.securityfocus.com/bid/19157 ExploitVendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/27947
https://www.exploit-db.com/exploits/2072

Track CVE-2006-7070 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2006-5242Etomite sql injection vulnerabilitySQL injection vulnerability in Etomite Content Management System (CMS) before 0.6.1.1 allows remote attackers to execute arbitrary SQL commands via u…EPSS 1.2%7.5CVE-2006-0325Etomite os command injection vulnerabilityEtomite Content Management System 0.6, and possibly earlier versions, when downloaded from the web site in January 2006 after January 10, contains a …EPSS 3.0%6.8CVE-2006-6048Etomite sql injection vulnerabilitySQL injection vulnerability in index.php in Etomite CMS 0.6.1.2, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL …EPSS 1.4%6.8CVE-2006-3904Etomite sql injection vulnerabilitySQL injection vulnerability in manager/index.php in Etomite CMS 0.6.1 and earlier, with magic_quotes_gpc disabled, allows remote attackers to execute…EPSS 1.9%5.8CVE-2006-6047Etomite path traversal vulnerabilityDirectory traversal vulnerability in manager/index.php in Etomite 0.6.1.2 allows remote authenticated administrators to include and execute arbitrary…EPSS 8.0%4.3CVE-2011-4264Etomite cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in Etomite before 1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.EPSS 0.85%4.3CVE-2008-0820Etomite cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in index.php in Etomite 0.6.1.4 Final allows remote attackers to inject arbitrary web script or HTML via $_S…EPSS 1.3%9.5CVE-2026-88771Citrix NetScaler Improper Input Validation VulnerabilityImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-…KEV

Source: NIST National Vulnerability Database (record CVE-2006-7070), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.