CVE-2006-5421: Wsn Forum

High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days.

WSN Forum 1.3.4 and earlier allows remote attackers to execute arbitrary PHP code via a modified pathname in the pathtoconfig parameter that points to an avatar image that contains PHP code, which is then accessed from prestart.php. NOTE: this issue has been labeled remote file inclusion, but that label only applies to the attack, not the underlying vulnerability.

Affected products

• Wsn Forum Wsn Forum: up to and including 1.3.4

Published 2006-10-20. Last modified 2026-06-16.