Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.0
CVE-2006-0702: imageVue 16.1 lets attackers upload files to server
CVE-2006-0702 · published 20 years ago
Summary
The upload feature in imageVue version 16.1 can be tricked into placing files in folders it shouldn’t by using ".." in the path. This could let an unauthenticated person add malicious files, potentially leading to further compromise of the web server. Update to a patched version or restrict the upload function until a fix is applied.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| imagevue | imagevue |
0.16.1 cpe:2.3:a:imagevue:imagevue:0.16.1:*:*:*:*:*:*:* |
Original advisory text
admin/upload.php in imageVue 16.1 allows remote attackers to upload arbitrary files to certain allowed folders via .. (dot dot) sequences in the path parameter. NOTE: due to the lack of details, t...
admin/upload.php in imageVue 16.1 allows remote attackers to upload arbitrary files to certain allowed folders via .. (dot dot) sequences in the path parameter. NOTE: due to the lack of details, the specific vulnerability type cannot be determined, although it might be due to directory traversal.
References
- http://secunia.com/advisories/18802 Exploit Vendor Advisory
- http://www.securityfocus.com/archive/1/424745/30/0/threaded Exploit Vendor Advisory
- http://www.securityfocus.com/bid/16594 Exploit
- http://www.vupen.com/english/advisories/2006/0570
- https://exchange.xforce.ibmcloud.com/vulnerabilities/24633
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Severity
5.0
Medium
Timeline
Published15 Feb 2006
Updated15 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-0702 · NVD
Track software like this
Free during beta