CVE-2005-4424
Directory traversal vulnerability in PHPKIT 1.6.1 R2 and earlier might allow remote authenticated...
Directory traversal vulnerability in PHPKIT 1.6.1 R2 and earlier might allow remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the path parameter and a %00 at the end of the filename, as demonstrated by an avatar filename ending with .png%00.
Exploit likelihood
What each source reports
NVD Score used
Directory traversal vulnerability in PHPKIT 1.6.1 R2 and earlier might allow remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the path parameter and a %00 at the end of the filename, as demonstrated by an avatar filename ending with .png%00.
- Record
CVE-2005-4424- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Directory traversal vulnerability in PHPKIT 1.6.1 R2 and earlier might allow remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the path parameter and a %00 at the end of the filename, as demonstrated by an avatar filename ending with .png%00.
- Record
CVE-2005-4424- Updated
- 2026-11-02
EUVDEUVD-2005-4419 No score
Directory traversal vulnerability in PHPKIT 1.6.1 R2 and earlier might allow remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the path parameter and a %00 at the end of the filename, as demonstrated by an avatar filename ending with .png%00.
- Record
EUVD-2005-4419- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pf68-x7c8-5h4p No score
Directory traversal vulnerability in PHPKIT 1.6.1 R2 and earlier might allow remote authenticated...
Directory traversal vulnerability in PHPKIT 1.6.1 R2 and earlier might allow remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the path parameter and a %00 at the end of the filename, as demonstrated by an avatar filename ending with .png%00.
- Record
GHSA-pf68-x7c8-5h4p- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-4424 is a medium vulnerability (CVSS 6.5) in Phpkit, published December 20, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.72%, the 77th percentile. No source names a fixed version.
References
securityfocus.com/bid/15354
cert.uni-stuttgart.de/archive/bugtraq/2005/11/msg00110.html
osvdb.org/20562
secunia.com/advisories/17479
hardened-php.net/advisory_212005.80.html
securityreason.com/securityalert/157
exchange.xforce.ibmcloud.com/vulnerabilities/23014
nvd.nist.gov/vuln/detail/CVE-2005-4424
github.com/advisories/GHSA-pf68-x7c8-5h4p