CVE-2006-4078
pm.php (aka the PM system) in DeluxeBB 1.08, and possibly earlier, allows remote attackers to...
CVE-2006-4078 is a high vulnerability (CVSS 7.5) in Deluxebb, published August 11, 2006. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.86%, the 79th percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 2.0, NVD
- Exploit chance
- 1.86%EPSS, 79th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
pm.php (aka the PM system) in DeluxeBB 1.08, and possibly earlier, allows remote attackers to bypass authentication by providing an arbitrary username in the membercookie cookie parameter.
Exploit likelihood
Affected products
What each source reports
NVD Score used
pm.php (aka the PM system) in DeluxeBB 1.08, and possibly earlier, allows remote attackers to bypass authentication by providing an arbitrary username in the membercookie cookie parameter.
- Record
CVE-2006-4078- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE ListNo score
pm.php (aka the PM system) in DeluxeBB 1.08, and possibly earlier, allows remote attackers to bypass authentication by providing an arbitrary username in the membercookie cookie parameter.
- Record
CVE-2006-4078- Updated
- 2026-11-02
EUVDEUVD-2006-4070No score
pm.php (aka the PM system) in DeluxeBB 1.08, and possibly earlier, allows remote attackers to bypass authentication by providing an arbitrary username in the membercookie cookie parameter.
- Record
EUVD-2006-4070- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f665-qj55-6rrxNo score
pm.php (aka the PM system) in DeluxeBB 1.08, and possibly earlier, allows remote attackers to...
pm.php (aka the PM system) in DeluxeBB 1.08, and possibly earlier, allows remote attackers to bypass authentication by providing an arbitrary username in the membercookie cookie parameter.
- Record
GHSA-f665-qj55-6rrx- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
exchange.xforce.ibmcloud.com/vulnerabilities/28270
osvdb.org/27834
securityreason.com/securityalert/1381
securityfocus.com/archive/1/442464/100/0/threaded
vupen.com/english/advisories/2006/3188
secunia.com/advisories/21387
nvd.nist.gov/vuln/detail/CVE-2006-4078
github.com/advisories/GHSA-f665-qj55-6rrx