CVE-2007-3096: Directory traversal vulnerability in login.php in PBLang (PBL) 4.67.16.a and earlier, when magic_quotes_gpc...

Security readout for executives and security teams

CVE-2007-3096 affects old PBLang forum installations. A remote attacker could abuse the language selection input to make login.php load local files when magic_quotes_gpc is disabled. If a vulnerable instance still exists, the business risk is server compromise, but evidence of current active exploitation is not provided. Exposure is likely limited to legacy PBLang 4.67.16.a or earlier deployments, especially internet-facing PHP sites with magic_quotes_gpc disabled. The source bundle does not provide CPEs, vendor metadata, or a confirmed fixed version. Treat as high priority only if PBLang is present. This is an old, niche product issue, but the impact can be severe on exposed legacy systems. If no PBLang exists in the environment, priority should be low after documentation. Mitigation focus: Inventory public and internal sites for PBLang installations.; Confirm whether any instance runs PBLang 4.67.16.a or earlier.; Check vendor or advisory guidance for a supported fixed release..

Prepared

Jun 29, 2026, 05:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.