CVE-2007-5186
PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when...
PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter, a different vector than CVE-2006-5497. NOTE: this issue was disputed, but the dispute was retracted after additional analysis.
Exploit likelihood
What each source reports
NVD Score used
PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter, a different vector than CVE-2006-5497. NOTE: this issue was disputed, but the dispute was retracted after additional analysis.
- Record
CVE-2007-5186- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter, a different vector than CVE-2006-5497. NOTE: this issue was disputed, but the dispute was retracted after additional analysis.
- Record
CVE-2007-5186- Updated
- 2026-11-02
EUVDEUVD-2007-5167 No score
PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter, a different vector than CVE-2006-5497. NOTE: this issue was disputed, but the dispute was retracted after additional analysis.
- Record
EUVD-2007-5167- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5q2v-rq3q-xc6m No score
PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when...
PHP remote file inclusion vulnerability in index.php in Segue CMS 1.8.4 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via a URL in the themesdir parameter, a different vector than CVE-2006-5497. NOTE: this issue was disputed, but the dispute was retracted after additional analysis.
- Record
GHSA-5q2v-rq3q-xc6m- Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Segue CMS 1.8.4 - 'index.php' Remote File Inclusion | 2007-10-01 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| aliases, exploits, facts, references, title | Exploit-DB, GitHub Advisories | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-5186 is a medium vulnerability (CVSS 6.8) in Segue Cms Cms, published October 3, 2007. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 46.8%, the 98th percentile. No source names a fixed version.