Unscored severity · published Sep 12, 2006
CVE-2006-4722
PHP remote file inclusion vulnerability in Open Bulletin Board (OpenBB) 1.0.8 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path…
–
CVSS
2.9%
EPSS
No
On KEV
Description
PHP remote file inclusion vulnerability in Open Bulletin Board (OpenBB) 1.0.8 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the root_path parameter to (1) index.php and possibly (2) collector.php.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openbb · Openbb
through 1.0.8; 1.0.0_beta1; 1.0.0_rc1; 1.0.0_rc2; 1.0.0_rc3; 1.0.5; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-4722
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-4722
securityreason.com
http://securityreason.com/securityalert/1552
www.securityfocus.com
http://www.securityfocus.com/archive/1/445743/100/0/threaded
Exploit
http://www.securityfocus.com/bid/19937
www.vupen.com
http://www.vupen.com/english/advisories/2006/3546
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/28838
More from Openbb
8.8
CVE-2004-1967
Cross-site request forgery (CSRF) vulnerabilities in (1) cp_forums.php, (2) cp_usergroup.php, (3) cp_ipbans.php, (4) myhome.php, (5) post.php, or (6) moderator.php in Open…
4.3
CVE-2026-116108
openbq-org OpenBB Local API Server api_settings.py access control
–
CVE-2005-2566
Multiple SQL injection vulnerabilities in Open Bulletin Board (OpenBB) allow remote attackers to execute arbitrary SQL commands via the (1) FID parameter to board.php or (2) UID…
–
CVE-2005-1612
SQL injection vulnerability in read.php in Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to execute arbitrary SQL commands via the TID parameter
–
CVE-2005-1613
Cross-site scripting (XSS) vulnerability in member.php in Open Bulletin Board (OpenBB) 1.0.8 allows remote attackers to inject arbitrary web script or HTML via the reverse…