CVE-2006-1152: PHP remote file inclusion vulnerability in index.php in M-Phorum 0.2 allows remote attackers to include arb...

Security readout for executives and security teams

An old PHP forum script may allow a website to load attacker-chosen files through a URL parameter. If exposed, this could let an attacker run unwanted PHP code. The CVE itself warns that the details come only from third-party reporting. Exposure appears limited to internet-accessible M-Phorum 0.2 deployments, or derived code retaining the same index.php go parameter behavior. The CVE lists affected vendor and product metadata as n/a. Treat as an unknown-severity legacy web exposure. Prioritize confirmation if the organization hosts old PHP forum software, especially internet-facing systems, but do not assume active exploitation from the provided evidence. Mitigation focus: Identify and remove any unused M-Phorum 0.2 deployments.; Check vendor or project guidance for an official fixed version or migration path.; Restrict public access to affected instances until remediation is confirmed..

Prepared

Jun 29, 2026, 13:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.