CVE-2006-3362
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file...
CVE-2006-3362 is a medium vulnerability (CVSS 5.1) in Geeklog, published July 6, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.06%, the 92nd percentile. No source names a fixed version.
- Severity
- 5.1 MediumCVSS 2.0, NVD
- Exploit chance
- 5.06%EPSS, 92nd percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | GeekLog 1.4.0sr3 - 'f(u)ckeditor' Remote Code Execution | 2006-06-29 |
What each source reports
NVD Score used
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
- Record
CVE-2006-3362- CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
- Record
CVE-2006-3362- Updated
- 2026-11-02
EUVDEUVD-2006-3358No score
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
- Record
EUVD-2006-3358- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-92qr-f662-7vcrNo score
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file...
Unrestricted file upload vulnerability in connectors/php/connector.php in FCKeditor mcpuk file manager, as used in (1) Geeklog 1.4.0 through 1.4.0sr3, (2) toendaCMS 1.0.0 Shizouka Stable and earlier, (3) WeBid 0.5.4, and possibly other products, when installed on Apache with mod_mime, allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension and a trailing extension that is allowed, such as .zip.
- Record
GHSA-92qr-f662-7vcr- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/19072
geeklog.net/article.php/geeklog-1.4.0sr4
exchange.xforce.ibmcloud.com/vulnerabilities/27469
Show 13 moreShow less
vupen.com/english/advisories/2006/2868
exploit-db.com/exploits/6344
secunia.com/advisories/20886
retrogod.altervista.org/toenda_100_shizouka_xpl.html
nvd.nist.gov/vuln/detail/CVE-2006-3362
github.com/advisories/GHSA-92qr-f662-7vcr