CVE-2006-5087: Multiple PHP remote file inclusion vulnerabilities in evoBB 0.3 and earlier allow remote attackers to execu...

Security readout for executives and security teams

CVE-2006-5087 affects evoBB 0.3 and earlier. A remote attacker could make vulnerable PHP files load attacker-controlled code through the path parameter, potentially taking over the web application. The source bundle does not provide CVSS, vendor fix details, or active exploitation evidence. Exposure is likely limited to legacy evoBB installations, especially internet-facing sites running version 0.3 or earlier. The bundle’s structured affected-product fields are incomplete, so confirmation requires local asset and code review. Treat as a high-priority legacy exposure if evoBB is present online. The business risk is remote code execution on an old web forum platform, but urgency depends on whether the application still exists in your environment. Mitigation focus: Check vendor or archived project guidance for a corrected evoBB release.; Retire, replace, or isolate evoBB 0.3 and earlier if no supported fix exists.; Restrict public access to affected endpoints until remediation is complete..

Prepared

Jun 29, 2026, 10:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.