CVE-2005-3926: Direct static code injection vulnerability in error.php in GuppY 4.5.9 and earlier, when register_globals i...

Security readout for executives and security teams

CVE-2005-3926 is a remote code execution issue in legacy GuppY CMS versions 4.5.9 and earlier. If an exposed site is still running this software, an attacker may be able to make the server write attacker-controlled PHP into an included file and run it. Exposure is most likely on legacy, internet-facing GuppY CMS deployments at version 4.5.9 or earlier with error.php reachable. The source bundle has incomplete structured affected-product data, so confirmation depends on asset discovery and application fingerprinting. Treat as urgent if GuppY is present on a public site. The issue is old, but remote PHP execution on an exposed CMS can lead to full site compromise. If no GuppY assets exist, no direct action is needed beyond recordkeeping. Mitigation focus: Identify any GuppY CMS installations and their versions.; Remove or isolate GuppY 4.5.9 and earlier from internet exposure.; Check vendor or project guidance for fixed versions or replacement recommendations..

Prepared

Jun 29, 2026, 16:18 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.