CVE-2007-4737

CVE-2007-4737 describes multiple remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) version 0.8.0. Attackers can exploit this by injecting a malicious URL into the STPHPLIB_DIR parameter of stphpapplication.php, stphpbtnimage.php, or stphpform.php, leading to arbitrary PHP code execution. This vulnerability has a CVSS score of 7.5, indicating high severity due to its network-based attack vector, low attack complexity, and potential for partial impact on confidentiality, integrity, and availability. While not listed on the KEV catalog, an ExploitDB entry (EDB-4358) confirms the existence of public exploit code, though there is no evidence of active exploitation or significant community discussion.