CVE-2005-2540: CRLF injection vulnerability in FlatNuke 2.5.5 and possibly earlier versions allows remote attackers to exe...

Security readout for executives and security teams

This is an old FlatNuke issue where attacker-controlled input in a signature field could become executable PHP on the server. If an exposed site still runs FlatNuke 2.5.5 or possibly earlier, compromise could affect the web server and hosted content. The public record does not provide CVSS scoring or confirmed active exploitation. Exposure is most likely on legacy, internet-facing FlatNuke installations, especially unmaintained PHP hosting. The CVE record lacks CPEs, detailed version bounds, and platform details, so asset confirmation requires local inventory rather than scanner metadata alone. Prioritize remediation if FlatNuke is still exposed to the internet. This is legacy software, but the impact is server-side command execution, so even one forgotten installation can create outsized business risk. Mitigation focus: Identify any FlatNuke deployments and confirm exact versions.; Remove or replace FlatNuke 2.5.5 or earlier where feasible.; Check archived vendor or maintainer guidance for fixed versions..

Prepared

Jun 29, 2026, 18:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.