CVE-2004-2538: Direct static code injection vulnerability in the PCG simple application generation in phpCodeGenie before...

Security readout for executives and security teams

CVE-2004-2538 affects phpCodeGenie before 3.0.2. An authenticated remote user could abuse the application generator’s header or footer inputs to inject static code that may execute on the server. This is most relevant to old, exposed phpCodeGenie installations. Likely limited to legacy phpCodeGenie deployments, especially development or admin-facing generators left reachable over a network. Exposure depends on whether versions before 3.0.2 are installed and whether authenticated users can access the affected generator functions. Treat as a targeted legacy risk. It does not appear broadly exploitable without credentials, but any exposed vulnerable instance could become a server compromise path. Prioritize discovery and retirement of old phpCodeGenie installations. Mitigation focus: Inventory phpCodeGenie instances and identify versions before 3.0.2.; Upgrade to phpCodeGenie 3.0.2 or later where feasible.; If unsupported, retire or isolate the phpCodeGenie deployment..

Prepared

Jun 29, 2026, 17:30 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.