CVE-2007-6471: Phpay

Medium severity, CVSS 5.8. EPSS: 2.3% chance of exploitation in the next 30 days.

Incomplete blacklist vulnerability in main.php in phPay 2.02.01 on Windows allows remote attackers to conduct directory traversal attacks and include and execute arbitrary local files via a ..\ (dot dot backslash) in the config parameter.

Affected products

• Phpay Phpay: version 2.2.1 only; version 2.02.01 only

Published 2007-12-20. Last modified 2026-06-16.