CVE-2006-3692

CVE-2006-3692 describes a remote file inclusion vulnerability in ListMessenger 0.9.3, specifically within the enduser/listmessenger.php component. Attackers could execute arbitrary PHP code by manipulating the lm_path parameter. Initially rated with a CVSS score of 7.5 (high severity), indicating easy exploitation over the network with potential for full compromise, the vendor disputed the claim, stating the variable was constant. CVE concurred with the vendor's assessment post-disclosure. While an ExploitDB entry exists, there is no evidence of active exploitation, Metasploit or Nuclei modules, or significant community discussion or media coverage.