CVE-2006-4594: Bugada Andrea PHP Advanced Transfer Manager

High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days.

Multiple PHP remote file inclusion vulnerabilities in PHP Advanced Transfer Manager (phpAtm) 1.21 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the include_location parameter in (1) confirm.php or (2) login.php. NOTE: the include_location parameter to index.php is already covered by CVE-2005-1681.

Affected products

• Bugada Andrea PHP Advanced Transfer Manager: up to and including 1.21; version 1.20 only

Published 2006-09-06. Last modified 2026-06-16.