VULNERABILITY INTELLIGENCE

CVE-2006-1371

CVSS score9 HIGH
EPSS probability9.61%
CISA KEVNot currently listed
Published2006-03-23
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:S/C:C/I:C/A:C

Description

Laurentiu Matei eXpandable Home Page (XHP) CMS 0.5 and earlier allows remote authenticated users to use the HTMLArea FileManager plugin to upload and execute arbitrary PHP files using (1) manager.php, (2) standalonemanager.php, and (3) images.php.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references