VULNERABILITY INTELLIGENCE
CVE-2004-2692
CVSS score9.3 HIGH
EPSS probability4.51%
CISA KEVNot currently listed
Published2004-12-31
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Description
The exec_dir PHP patch (php-exec-dir) 4.3.2 through 4.3.7 with safe mode disabled allows remote attackers to bypass restrictions and execute arbitrary commands via a backtick operator, which is not handled using the php_escape_shell_cmd function.