CVE-2006-4533
Multiple PHP remote file inclusion vulnerabilities in Plume CMS 1.0.6 and earlier allow remote attackers to execute arbitrary PHP code via the _PX_config[manager_path] parameter to (1) articles.php, (2) categories.php, (3) news.php, (4) prefs.php, (5) sites.php, (6) subtypes.php, (7) users.php, (8) xmedia.php, (9) frontinc/class.template.php, (10) inc/lib.text.php, (11) install/index.php, (12) install/upgrade.php, and (13) tools/htaccess/index.php. NOTE: other vectors are covered by CVE-2006-3562, CVE-2006-2645, and CVE-2006-0725.
Key facts
- CVSS score
- 7.5 (v2.0)
- Severity
- HIGH
- CVSS vector
AV:N/AC:L/Au:N/C:P/I:P/A:P- Weakness (CWE)
- CWE-94
- EPSS score
- 4.3% (91th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2006-4521)
- Published
- September 1, 2006
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2006-4521 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- plume-cms / plume cms
- plume-cms / plume cms
References
- http://packetstormsecurity.org/0608-exploits/plume-1.0.6.txt
- http://www.osvdb.org/31171
- http://www.osvdb.org/31172
- http://www.osvdb.org/31173
- http://www.osvdb.org/31174
- http://www.osvdb.org/31175
- http://www.osvdb.org/31176
- http://www.osvdb.org/31177
- http://www.osvdb.org/31178
- http://www.osvdb.org/31179
- http://www.osvdb.org/31180
- http://www.osvdb.org/31181
- http://www.osvdb.org/31182
- http://www.osvdb.org/31183
- http://www.securityfocus.com/bid/19629
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain