VULNERABILITY INTELLIGENCE

CVE-2006-3208

CVSS score6.5 MEDIUM
EPSS probability1.35%
CISA KEVNot currently listed
Published2006-06-24
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:S/C:P/I:P/A:P

Description

Direct static code injection vulnerability in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified "configuration fields" in (1) admin_chatconfig.php, (2) admin_configcss.php, (3) admin_config.php, or (4) admin_config2.php, which are stored as configuration settings. NOTE: this issue can be exploited by remote attackers by leveraging other vulnerabilities in UPB.

Primary references