CVE-2004-1723: The (1) updateuser.php and (2) forums_prune.php scripts in PHP-Fusion 4.00 allow remote attackers to obtain...

Security readout for executives and security teams

PHP-Fusion 4.00 can reveal its server installation path when certain scripts are requested directly. This does not grant access by itself, but it exposes internal filesystem details that can help attackers refine follow-on attacks against old PHP applications. Named exposure is PHP-Fusion 4.00 installations where the affected scripts are web-reachable. The bundle does not identify later versions, forks, hosted variants, or packaged distributions as affected. Low standalone urgency, but investigate quickly if legacy PHP-Fusion is still public-facing. The main risk is attacker reconnaissance against an obsolete application stack. Mitigation focus: Inventory public PHP-Fusion sites and identify any version 4.00 deployments.; Check vendor or project archives for official upgrade or hardening guidance.; Disable public access to unused administrative or maintenance scripts where supported..

Prepared

Jun 29, 2026, 23:55 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.