CVE-2006-5768

CVE-2006-5768 describes multiple remote file inclusion vulnerabilities in Cyberfolio 2.0 RC1 and earlier versions, specifically when the register_globals PHP setting is enabled. Attackers can exploit this by injecting a malicious URL into the "av" parameter of several PHP scripts, leading to the execution of arbitrary PHP code. The vulnerability carries a CVSS score of 7.5, indicating high severity due to its network-based attack vector, low complexity, and potential for complete compromise of confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, an exploit is publicly available on ExploitDB, though there is no evidence of widespread active exploitation or significant community discussion.