CVE-2006-5067
** DISPUTED ** PHP remote file inclusion vulnerability in loader.php in PHP System...
PHP remote file inclusion vulnerability in loader.php in PHP System Administration Toolkit (PHPSaTK) allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config] parameter. NOTE: this issue is disputed by CVE; analysis shows that the GLOBALS[config] variable is initialized before being used
Exploit likelihood
What each source reports
NVD Score used
PHP remote file inclusion vulnerability in loader.php in PHP System Administration Toolkit (PHPSaTK) allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config] parameter. NOTE: this issue is disputed by CVE; analysis shows that the GLOBALS[config] variable is initialized before being used
- Record
CVE-2006-5067- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
PHP remote file inclusion vulnerability in loader.php in PHP System Administration Toolkit (PHPSaTK) allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config] parameter. NOTE: this issue is disputed by CVE; analysis shows that the GLOBALS[config] variable is initialized before being used
- Record
CVE-2006-5067- Updated
- 2026-11-02
EUVDEUVD-2006-5052 No score
PHP remote file inclusion vulnerability in loader.php in PHP System Administration Toolkit (PHPSaTK) allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config] parameter. NOTE: this issue is disputed by CVE; analysis shows that the GLOBALS[config] variable is initialized before being used
- Record
EUVD-2006-5052- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7576-72m9-2cq9 No score
** DISPUTED ** PHP remote file inclusion vulnerability in loader.php in PHP System...
** DISPUTED ** PHP remote file inclusion vulnerability in loader.php in PHP System Administration Toolkit (PHPSaTK) allows remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[config] parameter. NOTE: this issue is disputed by CVE; analysis shows that the GLOBALS[config] variable is initialized before being used.
- Record
GHSA-7576-72m9-2cq9- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-5067 is a high vulnerability (CVSS 7.5) in Php System Administration Toolkit System Administration Toolkit, published September 28, 2006. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.67%, the 76th percentile.
References
securityfocus.com/archive/1/446882/100/0/threaded
exchange.xforce.ibmcloud.com/vulnerabilities/29133
attrition.org/pipermail/vim/2006-September/001054.html
securityreason.com/securityalert/1647
nvd.nist.gov/vuln/detail/CVE-2006-5067
github.com/advisories/GHSA-7576-72m9-2cq9