CVE-2002-1481: savesettings.php in phpGB 1.20 and earlier does not require authentication, which allows remote attackers t...

Security readout for executives and security teams

This is an old phpGB guestbook flaw where a settings script can be reached without logging in. If an exposed site still runs phpGB 1.20 or earlier, an attacker could change its configuration, break the site, or cause PHP code execution. Exposure is limited to legacy phpGB 1.20 and earlier deployments with savesettings.php reachable from untrusted networks. The bundle’s structured affected field is generic, but the CVE description names phpGB 1.20 and earlier. Prioritize quickly if any public website still runs phpGB. The product is old and likely rare, but an exposed vulnerable instance could become a full web-server compromise path. Mitigation focus: Identify and retire any phpGB 1.20 or earlier installations.; Restrict external access to savesettings.php and administrative paths.; Check vendor or archived project guidance for fixed releases or official workarounds..

Prepared

Jul 1, 2026, 02:44 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.