CVE-2005-2775: php_api.php in phpWebNotes 2.0.0 uses the extract function to modify key variables such as $t_path_core, wh...

Security readout for executives and security teams

phpWebNotes 2.0.0 can be tricked into loading PHP code through a controllable path variable in php_api.php. If reachable on an old public site, this could become server-side code execution. The provided sources do not include a CVSS score or current exploitation evidence. Exposure is likely limited to legacy internet-facing or intranet phpWebNotes 2.0.0 installations where php_api.php is accessible. The bundle does not identify affected forks, hosted services, supported packages, or versions beyond 2.0.0. Treat as high priority only where phpWebNotes 2.0.0 is still deployed. The business risk is potentially severe because the reported impact is arbitrary PHP execution, but exposure is likely narrow and legacy. Mitigation focus: Inventory for phpWebNotes 2.0.0 and exposed php_api.php files.; Remove or retire phpWebNotes if it is no longer business-required.; Check vendor or archival project guidance for any available fixed release..

Prepared

Jun 29, 2026, 17:57 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.