CVE-2006-5390: PHP remote file inclusion vulnerability in includes/functions_mod_user.php in the ACP User Registration (MM...

Security readout for executives and security teams

This is an old phpBB module issue where a web request could make PHP load attacker-controlled code through a path parameter. If the ACP User Registration (MMW) 1.00 module is still exposed, compromise could mean server-side code execution. Likely exposure is limited to legacy phpBB deployments that installed ACP User Registration (MMW) 1.00 and expose includes/functions_mod_user.php. The bundle’s structured affected-product fields are incomplete, so verify by asset inventory rather than product assumptions. Treat as high priority only if legacy phpBB with this module exists. The business risk is potentially full application/server compromise, but exposure should be uncommon in modern environments and must be confirmed. Mitigation focus: Inventory phpBB installations for ACP User Registration (MMW) 1.00.; Remove or disable the module if it is present and unnecessary.; Check phpBB and module advisory sources for any fixed release or vendor guidance..

Prepared

Jun 29, 2026, 09:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.