CVE-2006-2283
HighSummary
Multiple PHP remote file inclusion vulnerabilities in phpRaid 2.9.5 through 3.0.b3 allow remote attackers to execute arbitrary PHP code via the phpbb_root_path parameter in auth.php and auth_phpbb when phpBB portal is enabled, and via the smf_root_path parameter in auth.php and auth_SMF when SMF portal is enabled.
Risk Assessment
The risk is critical as an attacker can gain full control of the server, execute malicious code, and access sensitive data.
Recommendation
Immediately update phpRaid to the latest version or apply a security patch. If not possible, disable phpBB and SMF portals and restrict access to auth.php files.
Related vulnerabilities
- CVE-2026-86167Critical
A vulnerability was identified in Tenda HG10 (version 300001138) in the formgponConf function of the /boaform/admin/formgponConf file in the Boa component. Manipulation of the fmgpon_loid argument leads to OS command injection. The attack can be performed remotely, and the exploit is publicly available.
- CVE-2026-86165Critical
A vulnerability was found in Tenda HG10 (version 300001138) in the formURL function of the /boaform/admin/formURL file. Manipulation of the Keywd/urlFQDN arguments results in a buffer overflow. The attack can be initiated remotely, and the exploit has been made public.
- CVE-2026-86218Critical
N-central is vulnerable to pre-auth remote code execution. This issue affects N-central before version 2026.3.1.14.
- CVE-2026-75816Critical
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to and including 3.29.12. The pre_update_value function lacks capability or ownership checks, and ActionPost::conditions_logic() short-circuits the current_user_can('edit_post') authorization gate when the post ID is non-numeric, allowing unauthenticated form submissions to be routed to arbitrary user records. This enables unauthenticated attackers to overwrite any user's email address, including an administrator's, and then use WordPress's native password-reset flow to take over the account.
- CVE-2026-16310Critical
The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 1.8.5 via the 'id' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID during registration, and take over their account without any notification to the victim.
- CVE-2026-86153Critical
A vulnerability has been found in Tenda CP3 (version 27.5.57.101) in the CRedirServer::SetRedirectEnable function of the Functions/Redirect.cpp file. The manipulation leads to improper privilege management. Remote exploitation is possible.
- CVE-2026-86152Critical
A flaw has been found in Tenda CP3 (version 27.5.57.101) in the CAutoAddWifi::ThreadProc function of the Functions/AutoAddWifi.cpp file in the Kylin component. Executing a manipulation can lead to OS command injection. The attack may be launched remotely.
- CVE-2026-86151Critical
A vulnerability was detected in Tenda CP3 (version 27.5.57.101) in the sub_2F77E8 function of the Apis/system.c file in the Network Configuration Management component. Performing a manipulation results in OS command injection. The attack may be initiated remotely.
- CVE-2026-86149Critical
A vulnerability has been identified in Tenda CP3 27.5.57.101 in the file Net/NetCheckPing.cpp. Manipulation of the interface_name/host arguments causes OS command injection. The attack can be initiated remotely.
- CVE-2026-86148Critical
A vulnerability has been discovered in Tenda CP3 27.5.57.101 in the SystemAsh function of the file Apis/system.c of the Kylin component. Manipulation of the AlarmVoiceURL argument results in OS command injection. The attack can be launched remotely.
Original NVD description (English source)
Multiple PHP remote file inclusion vulnerabilities in SpiffyJr phpRaid 2.9.5 through 3.0.b3 allow remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter in (1) auth.php and (2) auth_phpbb when the phpBB portal is enabled, and via a URL in the smf_root_path parameter in (3) auth.php and (4) auth_SMF when the SMF portal is enabled.