CVE-2006-4450

Severity: medium (CVSS 5.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2006-08-30 · updated 2026-06-16

Description

usercp_avatar.php in PHPBB 2.0.20, when avatar uploading is enabled, allows remote attackers to use the server as a web proxy by submitting a URL to the avatarurl parameter, which is then used in an HTTP GET request.

Affected products

Phpbb Group Phpbb: 2.0.20

References

http://archives.neohapsis.com/archives/bugtraq/2006-05/0238.html
http://secunia.com/advisories/20093
http://securityreason.com/securityalert/1470
http://www.securityfocus.com/bid/17965
https://exchange.xforce.ibmcloud.com/vulnerabilities/26537
http://archives.neohapsis.com/archives/bugtraq/2006-05/0238.html
http://secunia.com/advisories/20093
http://securityreason.com/securityalert/1470
http://www.securityfocus.com/bid/17965
https://exchange.xforce.ibmcloud.com/vulnerabilities/26537

Get alerted when CVE-2006-4450 or the next vulnerability affects your stack