CVE-2006-5191
CVE-2006-5191 is a medium-severity vulnerability in Phpbb with a CVSS 2.0 base score of 5.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-94.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.1)
- EPSS exploit prediction: 3% (86th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-94
- Affected product: Phpbb
- Published:
- Last modified:
Description
PHP remote file inclusion vulnerability in includes/functions_static_topics.php in the Nivisec Static Topics module for phpBB 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Frequently asked questions
- What is CVE-2006-5191?
- PHP remote file inclusion vulnerability in includes/functions_static_topics.php in the Nivisec Static Topics module for phpBB 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
- How severe is CVE-2006-5191?
- CVE-2006-5191 has a CVSS 2.0 base score of 5.1, rated medium severity.
- Is CVE-2006-5191 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 3% (86th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2006-5191?
- CVE-2006-5191 affects Phpbb. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2006-5191?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2006-5191 published?
- CVE-2006-5191 was published on 2006-10-10 and last updated on 2026-06-16.
References
- http://secunia.com/advisories/22269
- http://www.nivisec.com/article.php?l=vi&ar=20
- http://www.osvdb.org/29506
- http://www.securityfocus.com/bid/20353
- http://www.vupen.com/english/advisories/2006/3916
- https://exchange.xforce.ibmcloud.com/vulnerabilities/29347
- https://www.exploit-db.com/exploits/2477/
Affected products (1)
- cpe:2.3:a:phpbb:phpbb:*:*:*:*:*:*:*:*
More vulnerabilities in Phpbb
- CVE-2008-3224 — Critical (CVSS 10.0): Unspecified vulnerability in phpBB before 3.0.1 has unknown impact and attack vectors related to "urls gone through…
- CVE-2008-1766 — Critical (CVSS 10.0): Multiple unspecified vulnerabilities in phpBB before 3.0.1 have unknown impact and attack vectors, related to "two…
- CVE-2025-70810 — High (CVSS 8.8): Cross Site Request Forgery vulnerability in Phpbb phbb3 v.3.3.15 allows a local attacker to execute arbitrary code via…
- CVE-2019-16993 — High (CVSS 8.8): In phpBB before 3.1.7-PL1, includes/acp/acp_bbcodes.php has improper verification of a CSRF token on the BBCode page in…
- CVE-2001-1471 — High (CVSS 8.8): prefs.php in phpBB 1.4.0 and earlier allows remote authenticated users to execute arbitrary PHP code via an invalid…
- CVE-2026-29199 — High (CVSS 8.1): phpBB before 3.3.16 is vulnerable to Host Header Injection that can lead to password rest link poisoning. When…
Other CWE-94 (Code Injection) vulnerabilities
- CVE-2026-57624 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.
- CVE-2026-10134 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read…
- CVE-2026-53576 — Critical (CVSS 10.0): Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter…
- CVE-2026-10561 — Critical (CVSS 10.0): IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined…
- CVE-2026-25470 — Critical (CVSS 10.0): Improper Control of Generation of Code ('Code Injection') vulnerability in ACPT ACPT (Pro) - Custom Post Types Plugin…
- CVE-2026-48836 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.