CVE-2006-5137
23Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 2.1%
from disclosure to weapon0 days
Published on NVDOct 2
1st PoCSep 29
exploitation probability
2.1%top 19% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
Multiple direct static code injection vulnerabilities in Groupee UBB.threads 6.5.1.1 allow remote attackers to (1) inject PHP code via a theme[] array parameter to admin/doedittheme.php, which is injected into includes/theme.inc.php; (2) inject PHP code via a config[] array parameter to admin/doeditconfig.php, and then execute the code via includes/config.inc.php; and inject a reference to PHP code via a URL in the config[path] parameter, and then execute the code via (3) dorateuser.php, (4) calendar.php, and unspecified other scripts.
Affected products
n/a · n/apublic PoCs found — 1✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/2457⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.