VULNERABILITY INTELLIGENCE
CVE-2006-7173
CVSS score10 HIGH
EPSS probability4.01%
CISA KEVNot currently listed
Published2007-03-20
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Description
Direct static code injection vulnerability in admin.php in PHP-Stats 0.1.9.1b and earlier allows remote attackers to execute arbitrary PHP code via a crafted option_new[report_w_day] parameter in a preferenze action, which can be later accessed via option/php-stats-options.php.