CVE-2005-2691
HighSummary
The vulnerability in includes/common.php in RunCMS 1.2 and earlier uses the extract function with EXTR_OVERWRITE on HTTP POST variables, allowing remote attackers to overwrite arbitrary variables, potentially leading to arbitrary code execution.
Risk Assessment
The risk for the organization includes the possibility of remote code execution, which could compromise data confidentiality, integrity, and availability.
Recommendation
It is recommended to immediately upgrade RunCMS to a version later than 1.2 that fixes this vulnerability. If an upgrade is not possible, manually modify the code in includes/common.php to prevent overwriting variables from external input.
Related vulnerabilities
- CVE-2026-85509Critical
FreeIPMI before version 1.6.19 contains a stack-based buffer overflow in the _read_fru_data function in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.
- CVE-2026-85508Critical
The ipmi-oem tool in FreeIPMI before version 1.6.19 has a stack-based buffer overflow in the _output_dell_system_info_cmc_ipv6_info function in ipmi-oem/ipmi-oem-dell.c, triggered by the cmc-ipv6-info subcommand of dell get-system-info.
- CVE-2026-85507Critical
The ipmi-oem tool in FreeIPMI before version 1.6.19 has a stack-based buffer overflow in the _output_dell_system_info_cmc_info function in ipmi-oem/ipmi-oem-dell.c, triggered by the cmc-info subcommand of dell get-system-info.
- CVE-2026-85506Critical
The ipmi-oem tool in FreeIPMI before version 1.6.19 has a stack-based buffer overflow in the _get_dell_system_info_idrac_info function in ipmi-oem/ipmi-oem-dell.c, triggered by the idrac-info subcommand of dell get-system-info.
- CVE-2026-85504Critical
FreeIPMI before version 1.6.19 has a stack-based buffer overflow in the _ipmi_sel_oem_fujitsu_get_sel_entry_long_text function in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c, triggered by malformed Fujitsu SEL long-text responses.
- CVE-2026-11613Critical
The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 5.1.2 via the 'custom_loop_template' parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, enabling execution of any PHP code in those files. The vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.
- CVE-2026-85148Critical
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts.
- CVE-2026-85146Critical
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code.
- CVE-2026-75754Critical
ASUS Control Center has vulnerabilities: Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials. An unauthorized user can obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in with hardcoded credentials to obtain a root shell, enabling direct reading, writing, and deletion of data on ASUS Control Center, as well as remote control of all servers, PCs, and workstations within the company.
- CVE-2026-67402Critical
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.
Original NVD description (English source)
includes/common.php in RunCMS 1.2 and earlier calls the extract function with EXTR_OVERWRITE on HTTP POST variables, which allows remote attackers to overwrite arbitrary variables, possibly allowing execution of arbitrary code.