{"api_version":"1","generated_at":"2026-07-23T08:39:39+00:00","cve":"CVE-2006-2686","urls":{"html":"https://cve.report/CVE-2006-2686","api":"https://cve.report/api/cve/CVE-2006-2686.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2006-2686","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2006-2686"},"summary":{"title":"CVE-2006-2686","description":"PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[AA_INC_PATH] parameter in (1) cached.php3, (2) cron.php3, (3) discussion.php3, (4) filldisc.php3, (5) filler.php3, (6) fillform.php3, (7) go.php3, (8) hiercons.php3, (9) jsview.php3, (10) live_checkbox.php3, (11) offline.php3, (12) post2shtml.php3, (13) search.php3, (14) slice.php3, (15) sql_update.php3, (16) view.php3, (17) multiple files in the (18) admin/ folder, (19) includes folder, and (20) modules/ folder.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2006-05-31 10:06:00","updated_at":"2017-10-19 01:29:00"},"problem_types":["CWE-94"],"metrics":[],"references":[{"url":"http://www.osvdb.org/27262","name":"27262","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27297","name":"27297","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27271","name":"27271","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27284","name":"27284","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27290","name":"27290","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27265","name":"27265","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27283","name":"27283","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27257","name":"27257","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27276","name":"27276","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27303","name":"27303","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27310","name":"27310","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27299","name":"27299","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27278","name":"27278","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27259","name":"27259","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/19133","name":"19133","refsource":"BID","tags":[],"title":"ActionApps Multiple Remote File Include Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.osvdb.org/27304","name":"27304","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://secunia.com/advisories/20299","name":"20299","refsource":"SECUNIA","tags":["Exploit","Vendor Advisory"],"title":"ActionApps \"GLOBALS[AA_INC_PATH]\" File Inclusion - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/27301","name":"27301","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27288","name":"27288","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.exploit-db.com/exploits/1829","name":"1829","refsource":"EXPLOIT-DB","tags":[],"title":"APC ActionApps CMS 2.8.1 Remote File Include Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/27306","name":"27306","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27269","name":"27269","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27260","name":"27260","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27295","name":"27295","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27273","name":"27273","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27286","name":"27286","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27292","name":"27292","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27267","name":"27267","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27308","name":"27308","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27281","name":"27281","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27274","name":"27274","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27279","name":"27279","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27258","name":"27258","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27305","name":"27305","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27302","name":"27302","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27298","name":"27298","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27291","name":"27291","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27264","name":"27264","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26776","name":"actionapps-globals-file-include(26776)","refsource":"XF","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/27282","name":"27282","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27256","name":"27256","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27277","name":"27277","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27263","name":"27263","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27296","name":"27296","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27270","name":"27270","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27285","name":"27285","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27293","name":"27293","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.vupen.com/english/advisories/2006/1997","name":"ADV-2006-1997","refsource":"VUPEN","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/27266","name":"27266","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27280","name":"27280","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27309","name":"27309","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27275","name":"27275","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27254","name":"27254","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27261","name":"27261","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27294","name":"27294","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27253","name":"27253","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27272","name":"27272","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27287","name":"27287","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27268","name":"27268","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27289","name":"27289","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.osvdb.org/27300","name":"27300","refsource":"OSVDB","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2006-2686","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-2686","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2006","cve_id":"2686","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"actionapps","cpe5":"actionapps","cpe6":"2.8.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2006","cve_id":"2686","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"actionapps","cpe5":"actionapps","cpe6":"2.8.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2006-2686","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[AA_INC_PATH] parameter in (1) cached.php3, (2) cron.php3, (3) discussion.php3, (4) filldisc.php3, (5) filler.php3, (6) fillform.php3, (7) go.php3, (8) hiercons.php3, (9) jsview.php3, (10) live_checkbox.php3, (11) offline.php3, (12) post2shtml.php3, (13) search.php3, (14) slice.php3, (15) sql_update.php3, (16) view.php3, (17) multiple files in the (18) admin/ folder, (19) includes folder, and (20) modules/ folder."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"27308","refsource":"OSVDB","url":"http://www.osvdb.org/27308"},{"name":"27289","refsource":"OSVDB","url":"http://www.osvdb.org/27289"},{"name":"27304","refsource":"OSVDB","url":"http://www.osvdb.org/27304"},{"name":"27269","refsource":"OSVDB","url":"http://www.osvdb.org/27269"},{"name":"27256","refsource":"OSVDB","url":"http://www.osvdb.org/27256"},{"name":"1829","refsource":"EXPLOIT-DB","url":"https://www.exploit-db.com/exploits/1829"},{"name":"27275","refsource":"OSVDB","url":"http://www.osvdb.org/27275"},{"name":"27270","refsource":"OSVDB","url":"http://www.osvdb.org/27270"},{"name":"27292","refsource":"OSVDB","url":"http://www.osvdb.org/27292"},{"name":"actionapps-globals-file-include(26776)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/26776"},{"name":"ADV-2006-1997","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2006/1997"},{"name":"27305","refsource":"OSVDB","url":"http://www.osvdb.org/27305"},{"name":"27272","refsource":"OSVDB","url":"http://www.osvdb.org/27272"},{"name":"27278","refsource":"OSVDB","url":"http://www.osvdb.org/27278"},{"name":"27294","refsource":"OSVDB","url":"http://www.osvdb.org/27294"},{"name":"27273","refsource":"OSVDB","url":"http://www.osvdb.org/27273"},{"name":"27287","refsource":"OSVDB","url":"http://www.osvdb.org/27287"},{"name":"27274","refsource":"OSVDB","url":"http://www.osvdb.org/27274"},{"name":"27284","refsource":"OSVDB","url":"http://www.osvdb.org/27284"},{"name":"27253","refsource":"OSVDB","url":"http://www.osvdb.org/27253"},{"name":"27276","refsource":"OSVDB","url":"http://www.osvdb.org/27276"},{"name":"27306","refsource":"OSVDB","url":"http://www.osvdb.org/27306"},{"name":"27263","refsource":"OSVDB","url":"http://www.osvdb.org/27263"},{"name":"27298","refsource":"OSVDB","url":"http://www.osvdb.org/27298"},{"name":"27295","refsource":"OSVDB","url":"http://www.osvdb.org/27295"},{"name":"27271","refsource":"OSVDB","url":"http://www.osvdb.org/27271"},{"name":"27288","refsource":"OSVDB","url":"http://www.osvdb.org/27288"},{"name":"27310","refsource":"OSVDB","url":"http://www.osvdb.org/27310"},{"name":"27264","refsource":"OSVDB","url":"http://www.osvdb.org/27264"},{"name":"27262","refsource":"OSVDB","url":"http://www.osvdb.org/27262"},{"name":"27257","refsource":"OSVDB","url":"http://www.osvdb.org/27257"},{"name":"27259","refsource":"OSVDB","url":"http://www.osvdb.org/27259"},{"name":"27280","refsource":"OSVDB","url":"http://www.osvdb.org/27280"},{"name":"20299","refsource":"SECUNIA","url":"http://secunia.com/advisories/20299"},{"name":"27309","refsource":"OSVDB","url":"http://www.osvdb.org/27309"},{"name":"27291","refsource":"OSVDB","url":"http://www.osvdb.org/27291"},{"name":"27267","refsource":"OSVDB","url":"http://www.osvdb.org/27267"},{"name":"27281","refsource":"OSVDB","url":"http://www.osvdb.org/27281"},{"name":"27282","refsource":"OSVDB","url":"http://www.osvdb.org/27282"},{"name":"27301","refsource":"OSVDB","url":"http://www.osvdb.org/27301"},{"name":"27254","refsource":"OSVDB","url":"http://www.osvdb.org/27254"},{"name":"27268","refsource":"OSVDB","url":"http://www.osvdb.org/27268"},{"name":"27258","refsource":"OSVDB","url":"http://www.osvdb.org/27258"},{"name":"27299","refsource":"OSVDB","url":"http://www.osvdb.org/27299"},{"name":"27300","refsource":"OSVDB","url":"http://www.osvdb.org/27300"},{"name":"27297","refsource":"OSVDB","url":"http://www.osvdb.org/27297"},{"name":"27285","refsource":"OSVDB","url":"http://www.osvdb.org/27285"},{"name":"27286","refsource":"OSVDB","url":"http://www.osvdb.org/27286"},{"name":"27296","refsource":"OSVDB","url":"http://www.osvdb.org/27296"},{"name":"27303","refsource":"OSVDB","url":"http://www.osvdb.org/27303"},{"name":"27279","refsource":"OSVDB","url":"http://www.osvdb.org/27279"},{"name":"27277","refsource":"OSVDB","url":"http://www.osvdb.org/27277"},{"name":"19133","refsource":"BID","url":"http://www.securityfocus.com/bid/19133"},{"name":"27283","refsource":"OSVDB","url":"http://www.osvdb.org/27283"},{"name":"27261","refsource":"OSVDB","url":"http://www.osvdb.org/27261"},{"name":"27302","refsource":"OSVDB","url":"http://www.osvdb.org/27302"},{"name":"27260","refsource":"OSVDB","url":"http://www.osvdb.org/27260"},{"name":"27266","refsource":"OSVDB","url":"http://www.osvdb.org/27266"},{"name":"27290","refsource":"OSVDB","url":"http://www.osvdb.org/27290"},{"name":"27293","refsource":"OSVDB","url":"http://www.osvdb.org/27293"},{"name":"27265","refsource":"OSVDB","url":"http://www.osvdb.org/27265"}]}},"nvd":{"publishedDate":"2006-05-31 10:06:00","lastModifiedDate":"2017-10-19 01:29:00","problem_types":["CWE-94"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":6.4},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":4.9,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:actionapps:actionapps:2.8.1:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2006","CveId":"2686","Ordinal":"18006","Title":"CVE-2006-2686","CVE":"CVE-2006-2686","Year":"2006"},"notes":[{"CveYear":"2006","CveId":"2686","Ordinal":"1","NoteData":"PHP remote file inclusion vulnerabilities in ActionApps 2.8.1 allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[AA_INC_PATH] parameter in (1) cached.php3, (2) cron.php3, (3) discussion.php3, (4) filldisc.php3, (5) filler.php3, (6) fillform.php3, (7) go.php3, (8) hiercons.php3, (9) jsview.php3, (10) live_checkbox.php3, (11) offline.php3, (12) post2shtml.php3, (13) search.php3, (14) slice.php3, (15) sql_update.php3, (16) view.php3, (17) multiple files in the (18) admin/ folder, (19) includes folder, and (20) modules/ folder.","Type":"Description","Title":null},{"CveYear":"2006","CveId":"2686","Ordinal":"2","NoteData":"2006-05-31","Type":"Other","Title":"Published"},{"CveYear":"2006","CveId":"2686","Ordinal":"3","NoteData":"2017-10-18","Type":"Other","Title":"Modified"}]}}}