CVE-2007-5984: Justin Hagstrom Autoindex PHP Script

High severity, CVSS 7.8. EPSS: 8.5% chance of exploitation in the next 30 days.

classes/Url.php in Justin Hagstrom AutoIndex PHP Script before 2.2.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via a %00 sequence in the dir parameter to index.php, which triggers an erroneous "recursive calculation."

Affected products

• Justin Hagstrom Autoindex PHP Script: version 2.0.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0.3 only; version 2.0.4 only; version 2.0.5 only; …

Published 2007-11-15. Last modified 2026-06-16.