CVE-2009-4887: Sbuilder CMS S.builder

Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days.

PHP remote file inclusion vulnerability in index.php in CMS S.Builder 3.7 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in a binn_include_path cookie. NOTE: this can also be leveraged to include and execute arbitrary local files.

Affected products

• Sbuilder CMS S.builder: up to and including 3.7

Published 2010-06-11. Last modified 2026-06-16.