CVE-2004-0285

highpriority · attend · 52EPSS 0.078 · 95 %ileexploit · functionalEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

3 exploits · functional

Likely / severe?

7.79% (95th) EPSS

CVSS 7.5 · high

Is it mine?

14 products

Check your exposure

Who says so?

2 sources

enisa_euvd · nvd

EPSS · scored 2026-10-26

PHP remote file inclusion vulnerabilities in include/footer.inc.php in (1) AllMyVisitors, (2) AllMyLinks, and (3) AllMyGuests allow remote attackers to execute arbitrary PHP code via a URL in the _AMVconfig[cfg_serverpath] parameter.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.19.3criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-829USprimary

exploits (3)

Public proof-of-concept and weaponised exploit code.

EDB-23697AllMyGuests 0.x - 'info.inc.php' Arbitrary Code Executionfunctional · exploit_db
EDB-23698AllMyVisitors 0.x - 'info.inc.php' Arbitrary Code Executionfunctional · exploit_db
EDB-23699AllMyLinks 0.x - 'footer.inc.php' Arbitrary Code Executionfunctional · exploit_db

affected products (14)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
allmyguests project allmyguests= 0.1.2nvdUScpe:2.3:a:allmyguests_project:allmyguests:*:*:*:*:*:*:*:*
allmyguests project allmyguests= 0.3nvdUScpe:2.3:a:allmyguests_project:allmyguests:*:*:*:*:*:*:*:*
allmyguests project allmyguests= 0.4nvdUScpe:2.3:a:allmyguests_project:allmyguests:*:*:*:*:*:*:*:*
allmyguests project allmyguests= 0.4.1nvdUScpe:2.3:a:allmyguests_project:allmyguests:*:*:*:*:*:*:*:*
allmylinks project allmylinks= 0.3nvdUScpe:2.3:a:allmylinks_project:allmylinks:*:*:*:*:*:*:*:*
allmylinks project allmylinks= 0.4nvdUScpe:2.3:a:allmylinks_project:allmylinks:*:*:*:*:*:*:*:*
allmylinks project allmylinks= 0.4.1nvdUScpe:2.3:a:allmylinks_project:allmylinks:*:*:*:*:*:*:*:*
allmylinks project allmylinks= 0.4.3nvdUScpe:2.3:a:allmylinks_project:allmylinks:*:*:*:*:*:*:*:*
allmylinks project allmylinks= 0.4.4nvdUScpe:2.3:a:allmylinks_project:allmylinks:*:*:*:*:*:*:*:*
allmylinks project allmylinks= 0.4.9nvdUScpe:2.3:a:allmylinks_project:allmylinks:*:*:*:*:*:*:*:*
allmylinks project allmylinks= 0.5nvdUScpe:2.3:a:allmylinks_project:allmylinks:*:*:*:*:*:*:*:*
allmyvisitors project allmyvisitors= 0.3nvdUScpe:2.3:a:allmyvisitors_project:allmyvisitors:*:*:*:*:*:*:*:*
allmyvisitors project allmyvisitors= 0.4nvdUScpe:2.3:a:allmyvisitors_project:allmyvisitors:*:*:*:*:*:*:*:*

also known as (2)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

enisa_euvd nvd NVD CVE.org MITRE

published 2004-11-23modified 2026-06-16

related (457)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-0770US	—OT critical	62.6% (99th)	KEV	2026-01-23
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary…
CVE-2025-32463US	high7.8OT critical	55.5% (99th)	KEV	2025-06-30
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
CVE-2018-17246US	critical9.8	84.3% (100th)	Exploit	2018-12-20
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that…
CVE-2023-48022US	critical9.8OT high	83.9% (100th)	Exploit	2023-11-28
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ra…
CVE-1999-0661US	high10.0	54.2% (99th)	Exploit	1999-01-01
A system is running a version of software that was replaced with a Trojan Horse at one of its distribution points, such as (1) TCP Wrappers 7.6, (2) util-linux 2.9g, (3) wuarchive…

+452 more

references (16)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan