CVE-2009-2095

no score yetEPSS 1.7%

PHP remote file inclusion vulnerability in template/simpledefault/admin/_masterlayout.php in Mundi Mail 0.8.2, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the top parameter. NOTE: when allow_url_fopen is disabled, directory traversal attacks are possible to include and execute arbitrary local files.

EPSS: 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
CWE: CWE-94
Published: 2009-06-17
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

mundi_king:mundi_mail

References

https://www.exploit-db.com/exploits/8948
https://www.exploit-db.com/exploits/8948

Check your stack JSON