CVE-2005-4094: connector.php in the fckeditor2rc2 addon in DoceboLMS 2.0.4 allows remote attackers to execute arbitrary PH...

Security readout for executives and security teams

CVE-2005-4094 is an old DoceboLMS 2.0.4 flaw where a bundled FCKeditor upload connector could accept a file that looked like an image but contained PHP. If exposed, an attacker could gain code execution on the web server. The source bundle does not provide CVSS, CWE, or vendor fix details. Exposure is most likely on legacy DoceboLMS 2.0.4 installations that still include the fckeditor2rc2 addon and expose connector.php to remote users. Current deployments are unlikely unless old systems, archives, or forgotten internal LMS instances remain online. Prioritize discovery over broad emergency response. If a public or business-critical DoceboLMS 2.0.4 instance is found, handle it as high priority because the described outcome is remote code execution. If no legacy instance exists, residual risk is low. Mitigation focus: Check DoceboLMS or vendor guidance for fixed versions or official workarounds.; Remove or restrict public access to the fckeditor2rc2 connector.php component.; Retire or isolate any remaining DoceboLMS 2.0.4 deployment..

Prepared

Jun 29, 2026, 16:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.