peter bassill · operator
$ cve CVE-2006-3475 JSON

CVE-2006-3475 EXPLOIT

7.5
HIGH · CVSS 2.0 · EPSS 8.2% (pctl 95)

Patch early

A public exploit exists.

Description

Multiple PHP remote file inclusion vulnerabilities in free QBoard 1.1 allow remote attackers to execute arbitrary PHP code via a URL in the qb_path parameter to (1) index.php, (2) about.php, (3) contact.php, (4) delete.php, (5) faq.php, (6) features.php or (7) history.php, a different set of vectors than CVE-2006-2998.

Scoring

CVSS7.5 (HIGH, v2.0)
VectorAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS8.17% — more likely to be exploited than 95% of all CVEs
On CISA KEVno
Public exploityes
Published2006-07-10
Last modified2026-06-16

Affected (1)

VendorProduct
free qboardfree qboard

Public exploits

SourceTitleDate
exploit-dbfree QBoard 1.1 - 'index.php?qb_path' Remote File Inclusion2006-07-03
exploit-dbfree QBoard 1.1 - 'about.php?qb_path' Remote File Inclusion2006-07-03
exploit-dbfree QBoard 1.1 - 'contact.php?qb_path' Remote File Inclusion2006-07-03
exploit-dbfree QBoard 1.1 - 'delete.php?qb_path' Remote File Inclusion2006-07-03
exploit-dbfree QBoard 1.1 - 'faq.php?qb_path' Remote File Inclusion2006-07-03
exploit-dbfree QBoard 1.1 - 'features.php?qb_path' Remote File Inclusion2006-07-03
exploit-dbfree QBoard 1.1 - 'history.php?qb_path' Remote File Inclusion2006-07-03

References

→ the Explorer  ·  watch your stack  ·  NVD