CVE-2004-0068: PHP remote file inclusion vulnerability in config.php for PhpDig 1.6.5 and earlier allows remote attackers...

Security readout for executives and security teams

This is an old PhpDig vulnerability that can let a remote attacker run PHP code on a vulnerable website. The issue involves config.php trusting a path parameter that can point to attacker-hosted code. No KEV listing is provided, so active exploitation is not established by the supplied sources. Exposure is most likely on legacy internet-facing sites still running PhpDig 1.6.5 or earlier. The provided bundle does not identify affected CPEs, supported branches, default install paths, or current vendor patch status. Treat exposed legacy PhpDig as urgent because the described impact is server-side code execution. Priority is highest where PhpDig is internet-facing, business-critical, or hosted with sensitive data. Lack of current exploit evidence reduces certainty, not impact. Mitigation focus: Inventory any PhpDig deployments and confirm whether versions are 1.6.5 or earlier.; Check archived vendor guidance before assuming a specific patch or configuration fix.; Retire, replace, or isolate vulnerable PhpDig instances if no supported fix is available..

Prepared

Jun 30, 2026, 03:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.