CVE-2010-1299

CVE-2010-1299 describes multiple remote file inclusion vulnerabilities in DynPG CMS version 4.1.0 and potentially earlier versions. These flaws allow remote attackers to execute arbitrary PHP code by injecting a URL into specific parameters within counter.php, guestbookaction.php, and popup.php, provided magic_quotes_gpc is disabled and register_globals is enabled. The vulnerability has a CVSS score of 5.1, indicating a medium severity, with a network-based attack vector, high attack complexity, and potential for partial compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, exploit code is publicly available on ExploitDB, though there is no evidence of active exploitation, Metasploit modules, or significant community discussion or media coverage.