Skip to content

CVE-2007-4737

Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0...

7.5 HighPublic exploit

CVE-2007-4737 is a high vulnerability (CVSS 7.5) in Speedtech Stphplibrary, published September 6, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.61%, the 95th percentile. No source names a fixed version.

Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the STPHPLIB_DIR parameter to (1) stphpapplication.php, (2) stphpbtnimage.php, or (3) stphpform.php.

Exploit likelihood

8.61%Up 7.2 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the STPHPLIB_DIR parameter to (1) stphpapplication.php, (2) stphpbtnimage.php, or (3) stphpform.php.

Record: CVE-2007-4737
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-94
Updated: 2026-11-02

CVE List No score

Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the STPHPLIB_DIR parameter to (1) stphpapplication.php, (2) stphpbtnimage.php, or (3) stphpform.php.

Record: CVE-2007-4737
Updated: 2026-11-02

EUVDEUVD-2007-4718 No score

Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the STPHPLIB_DIR parameter to (1) stphpapplication.php, (2) stphpbtnimage.php, or (3) stphpform.php.

Record: EUVD-2007-4718
Updated: 2026-11-03

GitHub AdvisoriesGHSA-rgrj-v98g-6x35 No score

Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0...

Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the STPHPLIB_DIR parameter to (1) stphpapplication.php, (2) stphpbtnimage.php, or (3) stphpform.php.

Record: GHSA-rgrj-v98g-6x35
Weakness: CWE-94
Updated: 2026-11-02

Affected products

speedtech stphplibrary

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	STPHPLibrary - 'STPHPLIB_DIR' Remote File Inclusion	2007-09-03

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD

References

Show 4 moreShow less