CVE-2006-0659: Runcms

Medium severity, CVSS 6.8. EPSS: 4.1% chance of exploitation in the next 30 days.

Multiple PHP remote file include vulnerabilities in RunCMS 1.2 and earlier, with register_globals and allow_url_fopen enabled, allow remote attackers to execute arbitrary code via the bbPath[path] parameter in (1) class.forumposts.php and (2) forumpollrenderer.php.

Affected products

• Runcms Runcms: up to and including 1.2; version 1.1 only; version 1.1a only

Published 2006-02-13. Last modified 2026-06-16.