CVE-2005-1181: n/a vulnerability

CVE-2005-1181: NOTE: this issue has been disputed by the vendor.

NOTE: this issue has been disputed by the vendor. PHP remote code injection vulnerability in loader.php for Ariadne CMS 2.4 allows remote attackers to execute arbitrary PHP code by modifying the ariadne parameter to reference a URL on a remote web server that contains the code. NOTE: the vendor has disputed this issue, saying that loader.php first requires the "ariadne.inc" file, which defines the $ariadne variable, and thus it cannot be modified by an attacker. In addition, CVE personnel have partially verified the dispute via source code inspection of Ariadne 2.4 as available on July 5, 2005

UnknownCVSS not scoredNot KEV-listedUpdatedAug 7, 2024, 21:44 UTC (UTC+00:00)

Security readout for executives and security teams

CVE-2005-1181 describes a claimed remote PHP code injection issue in Ariadne CMS 2.4 loader.php, but the vendor disputed it. CVE notes partial verification of the dispute through source inspection. Treat this as an uncertain legacy exposure, not a confirmed emergency. Exposure is likely limited to organizations still running Ariadne CMS 2.4, especially if publicly reachable. The source bundle provides no CPEs, no confirmed affected vendor record, and no supported-version mapping. Low to moderate priority unless Ariadne CMS 2.4 is present and exposed. The main task is confirming legacy exposure, not launching emergency response based on an unverified claim. Mitigation focus: Inventory for any Ariadne CMS 2.4 installations.; Check current vendor or maintainer guidance before applying assumptions.; Retire or isolate unsupported legacy CMS instances where feasible..

Prepared: Jun 29, 2026, 22:30 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2005-1181 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Apr 19, 2005, 04:00 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
ariadne-loaderphp-file-include(20611)CVE reference · vdb-entry, x_refsource_XF

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.