CVE-2006-3798: Deluxebb

Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days.

DeluxeBB 1.07 and earlier allows remote attackers to overwrite the (1) _GET, (2) _POST, (3) _ENV, and (4) _SERVER variables via the _COOKIE (aka COOKIE) variable, which can overwrite the other variables during an extract function call, probably leading to multiple security vulnerabilities, aka "pollution of the global namespace."

Affected products

• Deluxebb Deluxebb: version 1.05 only; version 1.06 only; version 1.07 only

Published 2006-07-24. Last modified 2026-06-16.