CVE-2006-2424: Ezusermanager

Medium severity, CVSS 5.1. EPSS: 3.3% chance of exploitation in the next 30 days.

PHP remote file inclusion vulnerability in ezUserManager 1.6 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the ezUserManager_Path parameter to ezusermanager_pwd_forgott.php, possibly due to an issue in ezusermanager_core.inc.php.

Affected products

• Ezusermanager Ezusermanager: version 1.5 only; version 1.6 only

Published 2006-05-17. Last modified 2026-06-16.