CVE-2006-0103: Ralph Capper Tinyphpforum

Medium severity, CVSS 5.0. EPSS: 4.1% chance of exploitation in the next 30 days.

TinyPHPForum 3.6 and earlier stores the (1) users/[USERNAME].hash and (2) users/[USERNAME].email files under the web root with insufficient access control, which allows remote attackers to list all registered users and possibly obtain other sensitive information.

Affected products

• Ralph Capper Tinyphpforum: version 3.5 only; version 3.6 only; version 3.46 only; version 3.47 only; version 3.48 only; version 3.49 only; …

Published 2006-01-06. Last modified 2026-06-16.