Skip to content

CVE-2007-5178

contrib/mx_glance_sdesc.php in the mx_glance 2.3.3 module for mxBB places a critical security...

6.8 MediumPublic exploit

CVE-2007-5178 is a medium vulnerability (CVSS 6.8) in Mxbb Mx Glance, published October 3, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.01%, the 87th percentile. No source names a fixed version.

contrib/mx_glance_sdesc.php in the mx_glance 2.3.3 module for mxBB places a critical security check within a comment because of a missing comment delimiter, which allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the mx_root_path parameter. NOTE: some sources incorrectly state that phpbb_root_path is the affected parameter.

Exploit likelihood

3.01%Down 4.2 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

contrib/mx_glance_sdesc.php in the mx_glance 2.3.3 module for mxBB places a critical security check within a comment because of a missing comment delimiter, which allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the mx_root_path parameter. NOTE: some sources incorrectly state that phpbb_root_path is the affected parameter.

Record: CVE-2007-5178
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-94
Updated: 2026-11-02

CVE List No score

contrib/mx_glance_sdesc.php in the mx_glance 2.3.3 module for mxBB places a critical security check within a comment because of a missing comment delimiter, which allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the mx_root_path parameter. NOTE: some sources incorrectly state that phpbb_root_path is the affected parameter.

Record: CVE-2007-5178
Updated: 2026-11-02

EUVDEUVD-2007-5159 No score

contrib/mx_glance_sdesc.php in the mx_glance 2.3.3 module for mxBB places a critical security check within a comment because of a missing comment delimiter, which allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the mx_root_path parameter. NOTE: some sources incorrectly state that phpbb_root_path is the affected parameter.

Record: EUVD-2007-5159
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hx4x-qj2r-6g94 No score

contrib/mx_glance_sdesc.php in the mx_glance 2.3.3 module for mxBB places a critical security...

contrib/mx_glance_sdesc.php in the mx_glance 2.3.3 module for mxBB places a critical security check within a comment because of a missing comment delimiter, which allows remote attackers to conduct remote file inclusion attacks and execute arbitrary PHP code via a URL in the mx_root_path parameter. NOTE: some sources incorrectly state that phpbb_root_path is the affected parameter.

Record: GHSA-hx4x-qj2r-6g94
Weakness: CWE-94
Updated: 2026-11-02

Affected products

mxbb mx glance

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	mxBB Module mx_glance 2.3.3 - Remote File Inclusion	2007-09-29

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	aliases, exploits, facts, references, title	Exploit-DB, GitHub Advisories
2026-11-02	created	CVE List, NVD

References

Show 4 moreShow less