CVE-2010-4867: W-Agora

High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days.

Directory traversal vulnerability in search.php3 (aka search.php) in W-Agora 4.2.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the bn parameter.

Affected products

• W-Agora W-Agora: up to and including 4.2.1; version 4.0.0 only; version 4.0.1 only; version 4.0.2 only; version 4.0.2a only; version 4.0.3 only; …

Published 2011-10-05. Last modified 2026-06-16.