CVE-2007-4906: PHP remote file inclusion vulnerability in tasks/send_queued_emails.php in NuclearBB Alpha 2, when register...

Security readout for executives and security teams

CVE-2007-4906 affects NuclearBB Alpha 2 systems where PHP register_globals is enabled. A remote attacker could make the application include attacker-controlled PHP through the vulnerable email-queue task, leading to arbitrary code execution. This is primarily a legacy exposure risk, but internet-facing instances should be treated seriously. Likely exposure is limited to legacy NuclearBB Alpha 2 deployments running with register_globals enabled, especially if the affected task script is reachable from the web. Modern environments are less likely to be exposed unless old code or migrated hosting remains online. Prioritize remediation if any public-facing legacy NuclearBB instance exists. The business concern is server compromise, not data exposure alone. If the software is retired or unreachable and register_globals is disabled, urgency drops substantially. Mitigation focus: Identify and retire any NuclearBB Alpha 2 installations.; Disable PHP register_globals wherever present.; Restrict public access to the affected task script..

Prepared

Jun 29, 2026, 03:38 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.