CVE-2006-5436: PHP remote file inclusion vulnerability in index.php in FreeFAQ 1.0.e allows remote attackers to execute ar...

Security readout for executives and security teams

FreeFAQ 1.0.e has an old PHP remote file inclusion flaw. If an exposed site is still running this software, an attacker could make it load attacker-controlled PHP and run code on the server. The business risk is serious for any remaining deployment, but exposure is likely limited to legacy systems. Exposure is most likely on old, internet-facing FreeFAQ installations that still serve index.php. The CVE affected-product metadata is incomplete, so teams should validate by asset discovery and code review rather than relying on scanner CPE matching alone. Prioritize remediation if FreeFAQ is present on any public server. The issue enables server-side code execution, but the software is old and likely uncommon; urgency depends on whether a live deployment exists. Mitigation focus: Identify and retire or replace any remaining FreeFAQ deployments.; Check vendor or project guidance for any available fixed release.; Restrict public access until the application is removed or fixed..

Prepared

Jun 29, 2026, 09:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.