CVE-2006-0725

CVE-2006-0725 describes a remote file inclusion vulnerability in Plume CMS 1.0.2, specifically within the prepend.php component, when the register_globals setting is enabled. Attackers can exploit this by injecting a malicious URL into the _PX_config[manager_path] parameter, leading to the execution of arbitrary code. This vulnerability carries a CVSS score of 6.8, indicating a medium severity with network-based attacks and moderate complexity, potentially resulting in partial confidentiality, integrity, and availability compromise. While not listed in CISA's KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.