CVE-2004-1820: PHP remote file inclusion vulnerability in displaycategory.php in 4nalbum 0.92 for PHP-Nuke 6.5 through 7.0...

Security readout for executives and security teams

CVE-2004-1820 is a remote file inclusion flaw in the 4nalbum 0.92 module for PHP-Nuke 6.5 through 7.0. A remote attacker could make the application load attacker-controlled PHP, leading to arbitrary code execution on the web server. Exposure is most likely on legacy internet-facing PHP-Nuke sites running 4nalbum 0.92 with displaycategory.php reachable. Modern environments are unlikely affected unless old PHP-Nuke code remains deployed, archived, or forgotten. Treat this as urgent if any legacy PHP-Nuke deployment is still internet-facing. Remote code execution can support full site compromise, but applicability is narrow and depends on old 4nalbum/PHP-Nuke assets being present. Mitigation focus: Inventory PHP-Nuke 6.5 through 7.0 sites for 4nalbum 0.92.; Check vendor or archived maintainer guidance for a fixed version or official workaround.; Disable or remove the exposed 4nalbum module if no supported fix is available..

Prepared

Jun 29, 2026, 21:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.