CVE-2006-4375: Mambo Contacts Xtd Component

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

PHP remote file inclusion vulnerability in contxtd.class.php in the Contacts XTD (ContXTD) component for Mambo (com_contxtd) allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. NOTE: another researcher has disputed this issue, saying that the software prevents the attack by checking whether _VALID_MOS is defined

Affected products

• Mambo Contacts Xtd Component: any version

Published 2006-08-26. Last modified 2026-06-16.