{"id":"CVE-2015-7381","aliases":["EUVD-2015-7305","GHSA-368c-mf93-2qrq"],"status":"published","title":"Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka...","description":"Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03199,"percentile":0.88217,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-94"],"published":"2015-09-28T01:00:00Z","modified":"2026-06-17T00:32:20Z","exploits":[{"source":"exploitdb","id":"EDB-38292","title":"refbase 0.9.6 - Multiple Vulnerabilities","type":"webapps","platform":"php","date":"2015-09-23","url":"https://www.exploit-db.com/exploits/38292"}],"products":[{"vendor":"refbase","product":"refbase"}],"references":[{"url":"http://www.kb.cert.org/vuls/id/374092","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7381"},{"url":"https://github.com/advisories/GHSA-368c-mf93-2qrq"}],"sources":{"cve":[{"id":"CVE-2015-7381","description":"Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.","status":"published","published":"2015-09-28T01:00:00Z","modified":"2024-08-06T07:51:27.097Z","updated_at":"2026-11-02T14:35:44.744952Z"}],"euvd":[{"id":"EUVD-2015-7305","description":"Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.","status":"published","published":"2015-09-28T01:00:00Z","modified":"2024-08-06T07:51:27Z","updated_at":"2026-11-03T02:21:52.959489Z"}],"ghsa":[{"id":"GHSA-368c-mf93-2qrq","title":"Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka...","description":"Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.","status":"published","published":"2022-05-17T04:06:49Z","modified":"2023-01-28T05:01:08Z","cwes":["CWE-94"],"updated_at":"2026-11-02T14:43:29.335465Z"}],"nvd":[{"id":"CVE-2015-7381","description":"Multiple PHP remote file inclusion vulnerabilities in install.php in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary PHP code via the (1) pathToMYSQL or (2) databaseStructureFile parameter, a different issue than CVE-2015-6008.","status":"published","published":"2015-09-28T02:59:14.933Z","modified":"2026-06-17T00:32:20.843Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:03:09.92183Z"}]}}