CVE-2006-2931
CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote...
CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files.
Exploit likelihood
What each source reports
NVD Score used
CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files.
- Record
CVE-2006-2931- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files.
- Record
CVE-2006-2931- Updated
- 2026-11-02
EUVDEUVD-2006-2928 No score
CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files.
- Record
EUVD-2006-2928- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5789-w37q-mfc3 No score
CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote...
CMS Mundo before 1.0 build 008 does not properly verify uploaded image files, which allows remote attackers to execute arbitrary PHP code by uploading and later directly accessing certain files.
- Record
GHSA-5789-w37q-mfc3- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-2931 is a medium vulnerability (CVSS 5.1) in Hotwebscripts Cms Mundo, published June 21, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.51%, the 74th percentile. No source names a fixed version.
References
secunia.com/secunia_research/2006-43/advisory
vupen.com/english/advisories/2006/2348
securityfocus.com/archive/1/437183/100/200/threaded
osvdb.org/26465
exchange.xforce.ibmcloud.com/vulnerabilities/27094
securitytracker.com/id?1016311
nvd.nist.gov/vuln/detail/CVE-2006-2931
github.com/advisories/GHSA-5789-w37q-mfc3