CVE-2006-3208

no score yetEPSS 1.4%

Direct static code injection vulnerability in Ultimate PHP Board (UPB) 1.9.6 and earlier allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified "configuration fields" in (1) admin_chatconfig.php, (2) admin_configcss.php, (3) admin_config.php, or (4) admin_config2.php, which are stored as configuration settings. NOTE: this issue can be exploited by remote attackers by leveraging other vulnerabilities in UPB.

EPSS: 1.4% chance of exploitation in the next 30 days; higher than 71% of CVEs (scores of 2026-10-31)
Published: 2006-06-24
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

ultimate_php_board:ultimate_php_board

References

http://securityreason.com/securityalert/1138
http://www.kliconsulting.com/users/mbrooks/UPB_0-day.txt
http://www.securityfocus.com/archive/1/437875/100/0/threaded
http://securityreason.com/securityalert/1138
http://www.kliconsulting.com/users/mbrooks/UPB_0-day.txt

Check your stack JSON