CVE-2006-5762: Free PHP Scripts Free File Hosting

Medium severity, CVSS 5.1. EPSS: 6.6% chance of exploitation in the next 30 days.

PHP remote file inclusion vulnerability in forgot_pass.php in Free File Hosting 1.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the AD_BODY_TEMP parameter. NOTE: this issue was later reported for the "File Upload System" which is a component of Free File Hosting. This also affects Free Image Hosting 2.0, which contains the same code.

Affected products

• Free PHP Scripts Free File Hosting: up to and including 1.1
• Free PHP Scripts Free Image Hosting: version 2.0 only

Published 2006-11-06. Last modified 2026-06-16.