CVE-2005-4195: Multiple SQL injection vulnerabilities in Scout Portal Toolkit (SPT) 1.3.1 and earlier allow remote attacke...

Security readout for executives and security teams

Scout Portal Toolkit has multiple SQL injection flaws that may let a remote attacker manipulate the portal database through public PHP parameters. The source bundle does not provide CVSS, CPEs, vendor ownership, or a named patch. Treat any internet-facing SPT deployment as a legacy high-risk exposure until verified removed, upgraded, or isolated. Exposure is likely limited to organizations still running legacy Scout Portal Toolkit, especially public SPT PHP routes. The bundle has no CPEs or vendor-normalized affected list, so asset discovery must rely on application names, route names, code inventories, and web content clues. Prioritize if SPT is internet-facing or tied to sensitive data. The issue is old, public, and database-impacting, but urgency depends on whether the legacy software still exists in the environment. Mitigation focus: Inventory public sites and repositories for Scout Portal Toolkit or SPT route names.; Remove or replace unsupported SPT deployments where business use is no longer required.; Check vendor or archive guidance; no patch is named in the source bundle..

Prepared

Jun 29, 2026, 16:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.