CVE-2008-1609: Jaf CMS

Medium severity, CVSS 6.8. EPSS: 44.3% chance of exploitation in the next 30 days.

Multiple PHP remote file inclusion vulnerabilities in just another flat file (JAF) CMS 4.0 RC2 allow remote attackers to execute arbitrary PHP code via a URL in the (1) website parameter to (a) forum.php, (b) headlines.php, and (c) main.php in forum/, and (2) main_dir parameter to forum/forum.php. NOTE: other main_dir vectors are already covered by CVE-2006-7127.

Affected products

• Jaf CMS Jaf CMS: version 4.0_rc2 only

Published 2008-04-01. Last modified 2026-06-16.