CVE-2006-1994

PHP remote file inclusion vulnerability in dForum 1.5 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the DFORUM_PATH parameter to (1) about.php, (2) admin.php, (3) anmelden.php, (4) losethread.php, (5) config.php, (6) delpost.php, (7) delthread.php, (8) dfcode.php, (9) download.php, (10) editanoc.php, (11) forum.php, (12) login.php, (13) makethread.php, (14) menu.php, (15) newthread.php, (16) openthread.php, (17) overview.php, (18) post.php, (19) suchen.php, (20) user.php, (21) userconfig.php, (22) userinfo.php, and (23) verwalten.php.

• http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/045369.html
• http://secunia.com/advisories/19788Vendor Advisory
• http://www.nukedx.com/?viewdoc=27Vendor Advisory
• http://www.securityfocus.com/archive/1/431758
• http://www.securityfocus.com/bid/17650Exploit
• http://www.vupen.com/english/advisories/2006/1482
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26035
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-April/045369.html
• http://secunia.com/advisories/19788Vendor Advisory
• http://www.nukedx.com/?viewdoc=27Vendor Advisory
• http://www.securityfocus.com/archive/1/431758
• http://www.securityfocus.com/bid/17650Exploit
• http://www.vupen.com/english/advisories/2006/1482
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26035

Published

Apr 25, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-1988The WebTextRenderer(WebInternal) _CG_drawRun:style:geometry:…
• CVE-2006-1989Buffer overflow in the get_database function in the HTTP cli…
• CVE-2006-1990Integer overflow in the wordwrap function in string.c in PHP…
• CVE-2006-1991The substr_compare function in string.c in PHP 5.1.2 allows …
• CVE-2006-1992mshtml.dll 6.00.2900.2873, as used in Microsoft Internet Exp…
• CVE-2006-1993Mozilla Firefox 1.5.0.2, when designMode is enabled, allows …
• CVE-2006-1995Directory traversal vulnerability in index.php in Scry Galle…
• CVE-2006-1996Scry Gallery 1.1 allows remote attackers to obtain sensitive…
• CVE-2006-1997Unspecified vulnerability in Sybase Pylon Anywhere groupware…
• CVE-2006-1998OpenTTD 0.4.7 and earlier allows local users to cause a deni…
• CVE-2006-1999The multiplayer menu in OpenTTD 0.4.7 allows remote attacker…
• CVE-2006-2000Cross-site scripting (XSS) vulnerability in /lms/a2z.jsp in …