{"id":"CVE-2006-7112","title":"Directory traversal vulnerability in error.php in MD-Pro 1.0.76 and earlier allows remote authenticated users to read and include arbitrary ","published":"2007-03-05T21:19:00.000Z","updated":"2026-06-16T18:34:24.243Z","severity":"medium","cvssScore":6,"epss":0.01688,"epssPct":0.77376,"kev":false,"maturity":"poc","actionScore":25,"primaryVendor":"maxdev","primaryProduct":"mdpro","cweId":"CWE-22","fixAvailable":false,"tags":["path-traversal","remote"],"epssDelta7":0.0008,"summary":"Directory traversal vulnerability in error.php in MD-Pro 1.0.76 and earlier allows remote authenticated users to read and include arbitrary files via the PNSVlang cookie, as demonstrated by uploading a GIF image using AddDownload or injecting PHP code into a log file, then accessing it.","cvssVector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","cvssVersion":"2.0","cvssSource":"nvd-primary","cweName":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-08-07T20:50:05.971Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:44:16.395Z","exploitdb":"2026-11-13T03:17:58.683Z"},"cvssCna":null,"hasPatchRef":false,"credits":[],"counts":{"exploitdb":1,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"maxdev","product":"mdpro","cpe":"cpe:2.3:a:maxdev:mdpro"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/30026","tags":null}],"exploits":[{"source":"exploitdb","kind":"webapps","date":"2006-11-04"}],"analysis":null,"affectedVersions":[{"vendor":"maxdev","product":"mdpro","version":"*","vsi":null,"vse":null,"vei":"1.0.76","vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}