CVE-2005-3416

phpBB 2.0.17 and earlier, when register_globals is enabled and the session_start function has not been called to handle a session, allows remote attackers to bypass security checks by setting the $_SESSION and $HTTP_SESSION_VARS variables to strings instead of arrays, which causes an array_merge function call to fail.

• http://marc.info/?l=bugtraq&m=113081113317600&w=2
• http://secunia.com/advisories/17366
• http://secunia.com/advisories/18098
• http://securityreason.com/securityalert/130
• http://securitytracker.com/id?1015121Patch, Vendor Advisory
• http://www.debian.org/security/2005/dsa-925
• http://www.hardened-php.net/advisory_172005.75.htmlVendor Advisory
• http://www.osvdb.org/20413
• http://www.securityfocus.com/bid/15243Patch
• http://marc.info/?l=bugtraq&m=113081113317600&w=2
• http://secunia.com/advisories/17366
• http://secunia.com/advisories/18098
• http://securityreason.com/securityalert/130
• http://securitytracker.com/id?1015121Patch, Vendor Advisory
• http://www.debian.org/security/2005/dsa-925
• http://www.hardened-php.net/advisory_172005.75.htmlVendor Advisory
• http://www.osvdb.org/20413
• http://www.securityfocus.com/bid/15243Patch

Published

Nov 1, 2005

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2005-3409OpenVPN 2.x before 2.0.4, when running in TCP mode, allows r…
• CVE-2005-3411Cross-site scripting (XSS) vulnerability in post.asp in Snit…
• CVE-2005-3412Cross-site scripting (XSS) vulnerability in Elite Forum 1.0.…
• CVE-2005-3413Cross-site scripting (XSS) vulnerability in desktop.php in e…
• CVE-2005-3414eyeOS 0.8.4 stores usrinfo.xml under the web document root w…
• CVE-2005-3415phpBB 2.0.17 and earlier allows remote attackers to bypass p…
• CVE-2005-3417phpBB 2.0.17 and earlier, when the register_long_arrays dire…
• CVE-2005-3418Multiple cross-site scripting (XSS) vulnerabilities in phpBB…
• CVE-2005-3419SQL injection vulnerability in usercp_register.php in phpBB …
• CVE-2005-3420usercp_register.php in phpBB 2.0.17 allows remote attackers …
• CVE-2005-3421estcmd in Hyper Estraier 1.0.1 on Windows systems allows rem…
• CVE-2005-3422Cross-site scripting (XSS) vulnerability in error.asp in ASP…