CVE-2006-2151: PHP remote file inclusion vulnerability in toplist.php in phpBB TopList 1.3.8 and earlier, when register_gl...

Security readout for executives and security teams

This is a legacy phpBB TopList issue where a public PHP page can be tricked into loading attacker-controlled files when PHP register_globals is enabled. Exposure is narrow, but on an affected internet-facing site the impact can be serious because file inclusion bugs can compromise the web application environment. Most exposure is likely old, self-hosted phpBB installations using phpBB TopList 1.3.8 or earlier with register_globals enabled and toplist.php reachable from the internet. Modern PHP stacks are less likely to be affected unless they preserve legacy configuration. Prioritize this if the organization still hosts legacy phpBB sites. It is not a broad modern-platform issue, but affected public systems should be handled quickly because public exploit references exist and the vulnerable configuration is high risk. Mitigation focus: Identify and remove phpBB TopList 1.3.8 or earlier where no longer needed.; Disable register_globals on any legacy PHP runtime where it remains enabled.; Restrict public access to toplist.php until exposure is resolved..

Prepared

Jun 29, 2026, 12:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.