CVE-2006-1371

high

Description

Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5 and earlier allows remote authenticated users to use the HTMLArea FileManager plugin to upload and execute arbitrary PHP files using (1) manager.php, (2) standalonemanager.php, and (3) images.php.

References

https://www.exploit-db.com/exploits/1605

https://exchange.xforce.ibmcloud.com/vulnerabilities/25399

http://xhp.targetit.ro/index.php?page=3&box_id=34&action=show_single_entry&post_id=10

http://www.vupen.com/english/advisories/2006/1052

http://www.securityfocus.com/bid/17209

http://www.osvdb.org/24059

http://www.osvdb.org/24058

http://www.attrition.org/pipermail/vim/2006-March/000649.html

Details

Source: Mitre, NVD

Published: 2006-03-23

Updated: 2026-06-16

Risk Information

CVSS v2

Base Score: 9

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H