CVE-2006-2516: Xoops

Medium severity, CVSS 5.1. EPSS: 6.4% chance of exploitation in the next 30 days.

mainfile.php in XOOPS 2.0.13.2 and earlier, when register_globals is enabled, allows remote attackers to overwrite variables such as $xoopsOption['nocommon'] and conduct directory traversal attacks or include PHP files via (1) xoopsConfig[language] to misc.php or (2) xoopsConfig[theme_set] to index.php, as demonstrated by injecting PHP sequences into a log file.

Affected products

• Xoops Xoops: up to and including 2.0.13.2; version 2.0 only; version 2.0.1 only; version 2.0.2 only; version 2.0.3 only; version 2.0.4 only; …

Published 2006-05-22. Last modified 2026-06-16.