CVE-2006-3692
** DISPUTED ** PHP remote file inclusion vulnerability in enduser/listmessenger.php in...
CVE-2006-3692 is a high vulnerability (CVSS 7.5) in Silentweb Listmessenger, published July 18, 2006. Its validity is disputed. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.65%, the 89th percentile.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 3.65%EPSS, 89th percentile
- Exploitation
- None known1 public exploit
- Fixed in
- No fix listedNo source names one
Description
PHP remote file inclusion vulnerability in enduser/listmessenger.php in ListMessenger 0.9.3 allows remote attackers to execute arbitrary PHP code via a URL in the lm_path parameter. NOTE: the vendor has disputed this issue to SecurityTracker, stating that the $lm_path variable is set to a constant value. As of 20060726, CVE concurs with the vendor based on SecurityTracker's post-disclosure analysis
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | ListMessenger 0.9.3 - 'LM_Path' Remote File Inclusion | 2006-07-17 |
What each source reports
NVD Score used
PHP remote file inclusion vulnerability in enduser/listmessenger.php in ListMessenger 0.9.3 allows remote attackers to execute arbitrary PHP code via a URL in the lm_path parameter. NOTE: the vendor has disputed this issue to SecurityTracker, stating that the $lm_path variable is set to a constant value. As of 20060726, CVE concurs with the vendor based on SecurityTracker's post-disclosure analysis
- Record
CVE-2006-3692- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
PHP remote file inclusion vulnerability in enduser/listmessenger.php in ListMessenger 0.9.3 allows remote attackers to execute arbitrary PHP code via a URL in the lm_path parameter. NOTE: the vendor has disputed this issue to SecurityTracker, stating that the $lm_path variable is set to a constant value. As of 20060726, CVE concurs with the vendor based on SecurityTracker's post-disclosure analysis
- Record
CVE-2006-3692- Updated
- 2026-11-02
EUVDEUVD-2006-3687No score
PHP remote file inclusion vulnerability in enduser/listmessenger.php in ListMessenger 0.9.3 allows remote attackers to execute arbitrary PHP code via a URL in the lm_path parameter. NOTE: the vendor has disputed this issue to SecurityTracker, stating that the $lm_path variable is set to a constant value. As of 20060726, CVE concurs with the vendor based on SecurityTracker's post-disclosure analysis
- Record
EUVD-2006-3687- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-48f5-m6h3-fv56No score
** DISPUTED ** PHP remote file inclusion vulnerability in enduser/listmessenger.php in...
** DISPUTED ** PHP remote file inclusion vulnerability in enduser/listmessenger.php in ListMessenger 0.9.3 allows remote attackers to execute arbitrary PHP code via a URL in the lm_path parameter. NOTE: the vendor has disputed this issue to SecurityTracker, stating that the $lm_path variable is set to a constant value. As of 20060726, CVE concurs with the vendor based on SecurityTracker's post-disclosure analysis.
- Record
GHSA-48f5-m6h3-fv56- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.