CVE-2006-6650: PHP remote file inclusion vulnerability in charts_constants.php in the Charts (mx_charts) 1.0.0 and earlier...

Security readout for executives and security teams

This is an old PHP remote file inclusion issue in the Charts mx_charts module for mxBB 1.0.0 and earlier. If a public site still runs it, an attacker may cause the app to load external PHP through module_root_path and execute code. Sources do not show active exploitation or a vendor patch detail. Exposure is likely limited to legacy mxBB sites running the Charts mx_charts module version 1.0.0 or earlier. Modern systems are affected only if this module or copied vulnerable code remains deployed and reachable. Prioritize if any public legacy mxBB site exists. The business risk is server compromise from a small, outdated module. If no mxBB or mx_charts deployment exists, document non-exposure and close with normal asset-management evidence. Mitigation focus: Identify and remove or disable mx_charts 1.0.0 and earlier.; Check vendor or project guidance for any available fixed release.; Restrict public access to legacy mxBB administrative and module paths..

Prepared

Jun 29, 2026, 08:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.