CVE-2007-2086

CVE-2007-2086 describes multiple remote file inclusion vulnerabilities in CNStats 2.9, specifically within the who_r.php and who_s.php scripts. Attackers can exploit this by injecting a malicious URL into the 'bj' parameter, leading to arbitrary PHP code execution. With a CVSS score of 6.8, this vulnerability is considered medium severity, requiring network access and medium attack complexity to achieve partial confidentiality, integrity, and availability impacts. While not listed on CISA's KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of active exploitation or significant community discussion.