CVE-2006-3755: PHP remote file inclusion vulnerability in Include/editor/class.rich.php in FlushCMS 1.0.0-pre2 and earlier...

Security readout for executives and security teams

This is an old reported remote file inclusion issue in FlushCMS 1.0.0-pre2 and earlier. If reachable, a vulnerable PHP file could be made to load attacker-controlled PHP, leading to arbitrary code execution. Public data is thin and provenance is explicitly uncertain, so urgency depends on whether any legacy FlushCMS instance remains online. Likely limited to legacy FlushCMS deployments, especially version 1.0.0-pre2 or earlier, if the affected PHP file is web-accessible. Modern environments are unlikely to be exposed unless they still host old FlushCMS code or archived sites. Treat as a legacy exposure discovery item, not a confirmed current crisis. Prioritize asset inventory and removal of obsolete FlushCMS instances, because the potential impact is code execution but the evidence base and exploitation status are weak. Mitigation focus: Inventory internet-facing sites for FlushCMS code or archived deployments.; Check vendor or project guidance for any fixed release or retirement recommendation.; Remove or isolate unsupported FlushCMS installations where business use is unclear..

Prepared

Jun 29, 2026, 11:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.