CVE-2006-2896

CVE-2006-2896 describes a critical vulnerability in FunkBoard CF0.71, where the profile.php script allows remote attackers to change arbitrary user passwords. This is achieved by manipulating a hidden 'uid' form field during an Edit Profile action. The vulnerability has a CVSS score of 5.0 (AV:N/AC:L/Au:N/C:N/I:P/A:N), indicating a network-based attack with low complexity, requiring no authentication, and leading to partial integrity impact (password changes). While not listed on the CISA KEV catalog or having Metasploit/Nuclei modules, an exploit is publicly available on ExploitDB (EDB-1875), though there is no evidence of active exploitation or significant community discussion.