CVE-2007-1976
** DISPUTED ** PHP remote file inclusion vulnerability in index.php in the Virii Info 1.10 and...
PHP remote file inclusion vulnerability in index.php in the Virii Info 1.10 and earlier module for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the xoopsConfig[root_path] parameter. NOTE: the issue has been disputed by a reliable third party, stating that the application's checkSuperglobals function defends against the attack
Exploit likelihood
What each source reports
NVD Score used
PHP remote file inclusion vulnerability in index.php in the Virii Info 1.10 and earlier module for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the xoopsConfig[root_path] parameter. NOTE: the issue has been disputed by a reliable third party, stating that the application's checkSuperglobals function defends against the attack
- Record
CVE-2007-1976- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
PHP remote file inclusion vulnerability in index.php in the Virii Info 1.10 and earlier module for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the xoopsConfig[root_path] parameter. NOTE: the issue has been disputed by a reliable third party, stating that the application's checkSuperglobals function defends against the attack
- Record
CVE-2007-1976- Updated
- 2026-11-02
EUVDEUVD-2007-1970 No score
PHP remote file inclusion vulnerability in index.php in the Virii Info 1.10 and earlier module for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the xoopsConfig[root_path] parameter. NOTE: the issue has been disputed by a reliable third party, stating that the application's checkSuperglobals function defends against the attack
- Record
EUVD-2007-1970- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-325v-5c6v-wv5g No score
** DISPUTED ** PHP remote file inclusion vulnerability in index.php in the Virii Info 1.10 and...
** DISPUTED ** PHP remote file inclusion vulnerability in index.php in the Virii Info 1.10 and earlier module for Xoops allows remote attackers to execute arbitrary PHP code via a URL in the xoopsConfig[root_path] parameter. NOTE: the issue has been disputed by a reliable third party, stating that the application's checkSuperglobals function defends against the attack.
- Record
GHSA-325v-5c6v-wv5g- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-1976 is a high vulnerability (CVSS 7.5) in Xoops Virii Info Module, published April 12, 2007. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.97%, the 80th percentile.
References
exploit-db.com/exploits/3642
vupen.com/english/advisories/2007/1206
osvdb.org/37429
exchange.xforce.ibmcloud.com/vulnerabilities/33368
attrition.org/pipermail/vim/2007-April/001490.html
nvd.nist.gov/vuln/detail/CVE-2007-1976
github.com/advisories/GHSA-325v-5c6v-wv5g