CVE-2007-5845

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

2.98%

Published

Nov 6, 2007

Modified

Jun 16, 2026

Public PoC / Exploit (3)

All weaponized →

Exploit-DBGuppY 4.5.16 - Remote Command Execution Exploit-DBGuppY 4.6.3 - 'index.php?selskin' Remote File Inclusion TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Directory traversal vulnerability in error.php in GuppY 4.6.3, 4.5.16, and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter. NOTE: this can be leveraged to bypass authentication and upload arbitrary files by including admin/inc/upload.inc and specifying certain multipart/form-data input for admin/inc/upload.inc.

Weaknesses (CWE)

CWE-94

Affected Products (2)

guppy · guppyvulnerable

References (8)

http://osvdb.org/38492

http://retrogod.altervista.org/guppy_4516_cmd.html

Exploit

https://www.exploit-db.com/exploits/3221

https://www.exploit-db.com/exploits/4602

http://osvdb.org/38492

http://retrogod.altervista.org/guppy_4516_cmd.html

Exploit

https://www.exploit-db.com/exploits/3221

https://www.exploit-db.com/exploits/4602

KEV Catalog EPSS Scores Vendors All CVEs