CVE-2006-3692: PHP remote file inclusion vulnerability in enduser/listmessenger.php in ListMessenger 0.9.3 allows remote a...

Security readout for executives and security teams

This is an old, disputed report about ListMessenger 0.9.3. The original claim alleged remote code execution through a PHP remote file inclusion issue. The vendor disputed it, saying the variable was fixed to a constant value, and CVE later concurred based on post-disclosure analysis. Exposure is mainly relevant to organizations with legacy ListMessenger 0.9.3 deployments. Based on the provided sources, practical exposure is uncertain and likely limited because the core exploitability claim was disputed and CVE concurred with the vendor. Treat this as a low-priority legacy verification item, not an emergency, unless an actual exposed ListMessenger instance shows request-controlled file inclusion behavior. Mitigation focus: Identify whether ListMessenger 0.9.3 is deployed anywhere.; Check vendor or SecurityTracker guidance before treating this as exploitable.; Remove unused legacy ListMessenger installations from public web servers..

Prepared

Jun 29, 2026, 11:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.