VULNERABILITY INTELLIGENCE

CVE-2007-2236

CVSS score6.8 MEDIUM
EPSS probability1.40%
CISA KEVNot currently listed
Published2007-04-25
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:P/I:P/A:P

Description

footer.php in PunBB 1.2.14 and earlier allows remote attackers to include local files in include/user/ via a cross-site scripting (XSS) attack, or via the pun_include tag, as demonstrated by use of admin_options.php to execute PHP code from an uploaded avatar file.

Primary references