CVE-2007-1906

MEDIO 6.8CVE-2007-1906 · Published 10/04/2007 · updated 16/06/2026

En resumen

CVE-2007-1906 es una vulnerabilidad MEDIO (CVSS 6.8) que afecta a hot editor (ecardmax.com).
Probabilidad de explotación en los próximos 30 días (EPSS): 3.3%, mayor que el 88.7% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
hot editor ecardmax.com	`= 4.0`	No fix yet

Description

Directory traversal vulnerability in richedit/keyboard.php in eCardMAX HotEditor (Hot Editor) 4.0, and the HotEditor plugin for MyBB, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the first parameter.

References

osvdb.org/34776
secunia.com/advisories/24825
securityreason.com/securityalert/2533
expw0rm.com/hot-editor-v40-local-file-inclusion_no113.html · Exploit
expw0rm.com/mybb-hot-editor-plugin-local-file-inclusion_no114.html · Exploit
securityfocus.com/archive/1/465092/100/0/threaded
securityfocus.com/archive/1/465094/100/0/threaded
securityfocus.com/bid/23377 · Exploit
vupen.com/english/advisories/2007/1315
exchange.xforce.ibmcloud.com/vulnerabilities/33521

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free