CVE-2006-2219

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-02-08 · updated 2026-06-16
Weakness: CWE-20

Description

phpBB 2.0.20 does not verify user-specified input variable types before being passed to type-dependent functions, which allows remote attackers to obtain sensitive information, as demonstrated by the (1) mode parameter to memberlist.php and the (2) highlight parameter to viewtopic.php that are used as an argument to the htmlspecialchars or urlencode functions, which displays the installation path in the resulting error message.

Affected products

Phpbb Group Phpbb: 2.0.20

References

http://marc.info/?l=bugtraq&m=114695651425026&w=2
http://marc.info/?l=bugtraq&m=114731067321710&w=2
http://marc.info/?l=full-disclosure&m=114685931319903&w=2
http://securityreason.com/securityalert/837
https://exchange.xforce.ibmcloud.com/vulnerabilities/26306
http://marc.info/?l=bugtraq&m=114695651425026&w=2
http://marc.info/?l=bugtraq&m=114731067321710&w=2
http://marc.info/?l=full-disclosure&m=114685931319903&w=2
http://securityreason.com/securityalert/837
https://exchange.xforce.ibmcloud.com/vulnerabilities/26306

Get alerted when CVE-2006-2219 or the next vulnerability affects your stack