CVE-2006-3362
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file...
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
Exploit likelihood
What each source reports
NVD Score used
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
- Record
CVE-2006-3362- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
- Record
CVE-2006-3362- Updated
- 2026-11-02
EUVDEUVD-2006-3358 No score
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
- Record
EUVD-2006-3358- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-92qr-f662-7vcr No score
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file...
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
- Record
GHSA-92qr-f662-7vcr- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | GeekLog 1.4.0sr3 - 'f(u)ckeditor' Remote Code Execution | 2006-06-29 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2006-3362 is a medium vulnerability (CVSS 5.1) in Geeklog, published July 6, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.06%, the 92nd percentile. No source names a fixed version.
References
securityfocus.com/bid/19072
geeklog.net/article.php/geeklog-1.4.0sr4
exchange.xforce.ibmcloud.com/vulnerabilities/27469
Show 13 moreShow less
vupen.com/english/advisories/2006/2868
exploit-db.com/exploits/6344
secunia.com/advisories/20886
retrogod.altervista.org/toenda_100_shizouka_xpl.html
nvd.nist.gov/vuln/detail/CVE-2006-3362
github.com/advisories/GHSA-92qr-f662-7vcr