CVE-2006-5832: Aiocp

Medium severity, CVSS 5.0. EPSS: 3.1% chance of exploitation in the next 30 days.

All In One Control Panel (AIOCP) 1.3.007 and earlier allows remote attackers to obtain the full path of the web server via certain requests to (1) public/code/cp_dpage.php, possibly involving the aiocp_dp[] parameter, (2) public/code/cp_show_ec_products.php, possibly involving the order_field[] parameter, and (3) public/code/cp_show_page_help.php, possibly involving the hp[] parameter, which reveal the path in various error messages.

Affected products

• Aiocp Aiocp: version 1.3.000 only; version 1.3.001 only; version 1.3.002 only; version 1.3.003 only; version 1.3.004 only; version 1.3.005 only; …

Published 2006-11-10. Last modified 2026-06-16.