CVE-2006-4078: Deluxebb

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

pm.php (aka the PM system) in DeluxeBB 1.08, and possibly earlier, allows remote attackers to bypass authentication by providing an arbitrary username in the membercookie cookie parameter.

Affected products

• Deluxebb Deluxebb: version 1.08 only

Published 2006-08-11. Last modified 2026-06-16.