CVE-2006-5387: PHP remote file inclusion vulnerability in mods/iai/includes/constants.php in the PlusXL 20_272 and earlier...

Security readout for executives and security teams

This is an old PHP remote file inclusion flaw in the PlusXL phpBB module. If an internet-facing site still runs PlusXL 20_272 or earlier, an attacker may be able to make the server run attacker-controlled PHP code. Sources do not provide CVSS, affected CPEs, or a named patch. Exposure is most likely on legacy phpBB sites using the PlusXL module, especially version 20_272 or earlier, where the affected constants.php path remains web-accessible. Modern environments are only in scope if they retain this old module or copied code. Treat this as high priority only if legacy PlusXL/phpBB assets exist. The business risk is server compromise from a very old component, but evidence is incomplete for current exploitation or a vendor patch path. Mitigation focus: Inventory phpBB installations for PlusXL 20_272 or earlier.; Remove or disable the PlusXL module if it is still present.; Check listed vendor and advisory sources for any fixed release guidance..

Prepared

Jun 29, 2026, 09:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.