← Vulnerability feed

Vulnerability record · CVE-2007-1525 · published 20 March 2007

CVE-2007-1525: Dayfox designs dayfox blog vulnerability

DDayfox Designs · Dayfox Blog

Direct static code injection vulnerability in postpost.php in Dayfox Blog (dfblog) 4 allows remote attackers to execute arbitrary PHP code via the cat parameter, which can be executed via a request to posts.php.

6.8 CVSS 2.0 Medium EPSS 37% · top 1.5%
6.8CVSS 2.0 base score
37%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References
16 Jun 2026Last modified by NVD

Description

Direct static code injection vulnerability in postpost.php in Dayfox Blog (dfblog) 4 allows remote attackers to execute arbitrary PHP code via the cat parameter, which can be executed via a request to posts.php.

AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://infusion.110mb.com/enter/dfblog4.zip
http://osvdb.org/34073
http://secunia.com/advisories/24534
http://www.securityfocus.com/bid/22972
http://www.vupen.com/english/advisories/2007/0969
https://www.exploit-db.com/exploits/3478
http://infusion.110mb.com/enter/dfblog4.zip
http://osvdb.org/34073
http://secunia.com/advisories/24534
http://www.securityfocus.com/bid/22972
http://www.vupen.com/english/advisories/2007/0969
https://www.exploit-db.com/exploits/3478

Track CVE-2007-1525 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2008-3564Dayfox designs dayfox blog path traversal vulnerabilityMultiple directory traversal vulnerabilities in index.php in Dayfox Blog 4 allow remote attackers to include and execute arbitrary local files via a …EPSS 2.5%7.5CVE-2007-0150Dayfox designs dayfox blog vulnerabilityMultiple PHP remote file inclusion vulnerabilities in index.php in Dayfox Blog allow remote attackers to execute arbitrary PHP code via a URL in the …EPSS 1.8%7.5CVE-2006-5183Dayfox designs dayfox blog vulnerabilityMultiple PHP remote file inclusion vulnerabilities in Dayfox Designs Dayfox Blog 2.0 allow remote attackers to execute arbitrary PHP code via a URL i…EPSS 1.5%7.5CVE-2006-2522Dayfox designs dayfox blog vulnerabilityDayfox Blog 2.0 and earlier stores user credentials in edit/slog_users.txt under the web document root with insufficient access control, which allows…EPSS 1.9%

Source: NIST National Vulnerability Database (record CVE-2007-1525), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.