CVE-2007-2255 — Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) eng_dir parameter to addmember.php, (2) lang_path parameter to admin/enginelib/class.phpmailer.php, and the (3) spaw_root parameter to admin/includes/spaw/dialogs/colorpicker.php, different vectors than CVE-2006-5291 and CVE-2006-5459

Back Back to CVE browser

HIGH

Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) eng_dir parameter to addmember.php, (2) lang_path parameter to admin/enginelib/class.phpmailer.php, and the (3) spaw_root parameter to admin/includes/spaw/dialogs/colorpicker.php, different vectors than CVE-2006-5291 and CVE-2006-5459

Published Apr 25, 2007

7.5

HIGH

CVSS 2.0

EPSS 1.74%

Description

Multiple PHP remote file inclusion vulnerabilities in Download-Engine 1.4.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) eng_dir parameter to addmember.php, (2) lang_path parameter to admin/enginelib/class.phpmailer.php, and the (3) spaw_root parameter to admin/includes/spaw/dialogs/colorpicker.php, different vectors than CVE-2006-5291 and CVE-2006-5459. NOTE: vector 3 might be an issue in SPAW.

Affected products

Remediation

No remediation recorded yet.

Metrics

1.74% 0.01744

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01744

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (16 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.74% (0.01744)	76.95th	v5 (v2026.06.15)
Jun 15, 2026	1.74% (0.01744)	74.77th	v5 (v2026.06.15)
Mar 17, 2025	1.04% (0.01039)	75.90th	v4 (v2025.03.14)
Dec 12, 2024	2.37% (0.02374)	90.24th	v3 (v2023.03.01)
Apr 5, 2024	2.37% (0.02374)	89.63th	v3 (v2023.03.01)
Feb 27, 2024	2.13% (0.02132)	88.94th	v3 (v2023.03.01)
Jan 20, 2024	2.08% (0.02083)	87.92th	v3 (v2023.03.01)
Dec 13, 2023	2.08% (0.02075)	87.82th	v3 (v2023.03.01)
Nov 5, 2023	1.98% (0.01978)	87.53th	v3 (v2023.03.01)
Sep 27, 2023	1.90% (0.01900)	87.13th	v3 (v2023.03.01)
May 1, 2023	1.69% (0.01690)	85.87th	v3 (v2023.03.01)
Mar 7, 2023	1.56% (0.01563)	85.16th	v3 (v2023.03.01)
Mar 6, 2023	1.32% (0.01319)	71.27th	v2 (v2022.01.01)
Feb 23, 2023	1.32% (0.01319)	71.23th	v2 (v2022.01.01)
Apr 1, 2022	1.32% (0.01319)	69.22th	v2 (v2022.01.01)
Feb 4, 2022	1.32% (0.01319)	44.98th	v2 (v2022.01.01)

Weaknesses (0)

No CWE recorded.

References (6)

http://osvdb.org/35398
vdb-entryx_refsource_OSVDB
http://osvdb.org/35399
vdb-entryx_refsource_OSVDB
http://osvdb.org/35400
vdb-entryx_refsource_OSVDB
http://securityreason.com/securityalert/2619
third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/archive/1/465984/100/100/threaded
mailing-listx_refsource_BUGTRAQ
https://exchange.xforce.ibmcloud.com/vulnerabilities/33723
vdb-entryx_refsource_XF

Link	Providers	Tags
http://osvdb.org/35398		vdb-entryx_refsource_OSVDB
http://osvdb.org/35399		vdb-entryx_refsource_OSVDB
http://osvdb.org/35400		vdb-entryx_refsource_OSVDB
http://securityreason.com/securityalert/2619		third-party-advisoryx_refsource_SREASON
http://www.securityfocus.com/archive/1/465984/100/100/threaded		mailing-listx_refsource_BUGTRAQ
https://exchange.xforce.ibmcloud.com/vulnerabilities/33723		vdb-entryx_refsource_XF

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Apr 25, 2007

Updated Aug 7, 2024

Reserved Apr 25, 2007

Link CVE-2007-2255

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 16, 2026

Link CVE-2007-2255

Red Hat

Severity n/a

Public date n/a

Links CVE-2007-2255