CVE-2006-4893

PHP remote file inclusion vulnerability in bb_usage_stats/includes/bb_usage_stats.php in phpBB XS 0.58 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter, a different vector than CVE-2006-4780.

• http://nyubicrew.org/adv/Noge_adv_02.txtExploit, URL Repurposed
• http://secunia.com/advisories/21970Vendor Advisory
• http://securityreason.com/securityalert/1617
• http://www.osvdb.org/28918
• http://www.securityfocus.com/archive/1/446108/100/0/threaded
• http://www.securityfocus.com/archive/1/452469/100/200/threaded
• http://www.securityfocus.com/bid/20046Exploit
• http://www.vupen.com/english/advisories/2006/3654
• http://nyubicrew.org/adv/Noge_adv_02.txtExploit, URL Repurposed
• http://secunia.com/advisories/21970Vendor Advisory
• http://securityreason.com/securityalert/1617
• http://www.osvdb.org/28918
• http://www.securityfocus.com/archive/1/446108/100/0/threaded
• http://www.securityfocus.com/archive/1/452469/100/200/threaded
• http://www.securityfocus.com/bid/20046Exploit
• http://www.vupen.com/english/advisories/2006/3654

Published

Sep 19, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-4887Apple Remote Desktop (ARD) for Mac OS X 10.2.8 and later doe…
• CVE-2006-4888Microsoft Internet Explorer 6 and earlier allows remote atta…
• CVE-2006-4889Multiple PHP remote file inclusion vulnerabilities in Teleko…
• CVE-2006-4890Multiple PHP remote file inclusion vulnerabilities in UNAK-C…
• CVE-2006-4891SQL injection vulnerability in ArticlesTableview.asp in Tech…
• CVE-2006-4892SQL injection vulnerability in faqview.asp in Techno Dreams …
• CVE-2006-4894Cross-site scripting (XSS) vulnerability in forms/lostpasswo…
• CVE-2006-4895IDevSpot NexieAffiliate 1.9 and earlier allows remote attack…
• CVE-2006-4896Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2006-4897CMtextS 1.0 and earlier stores users_logins/admin.txt under …
• CVE-2006-4898PHP remote file inclusion vulnerability in include/phpxd/php…
• CVE-2006-4899The ePPIServlet script in Computer Associates (CA) eTrust Se…