CVE-2006-1149

CVE-2006-1149 is a remote file inclusion vulnerability in OWL Intranet Engine version 0.82, specifically within the lib/OWL_API.php component. When the register_globals setting is enabled, attackers can exploit this by injecting a URL into the uninitialized xrms_file_root parameter, leading to the inclusion of arbitrary files. This vulnerability carries a high CVSS score of 7.5, indicating a critical risk due to its network-based attack vector, low attack complexity, and potential for full compromise of confidentiality, integrity, and availability. While not listed on the CISA KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of widespread active exploitation or significant community discussion.