CVE-2006-5240: PHP remote file inclusion vulnerability in engine/require.php in Docmint 2.0 and earlier, when register_glo...

Security readout for executives and security teams

Docmint 2.0 and earlier can let an internet user make the server include attacker-chosen PHP code if PHP register_globals is enabled. That can turn a website flaw into server-side code execution. The source bundle does not name a vendor patch or current exploitation. Exposure is likely limited to legacy Docmint 2.0 or earlier deployments, especially internet-facing PHP installations where register_globals remains enabled. Modern environments are less likely to be affected unless old application stacks are preserved. Prioritize if Docmint is present on an internet-facing or business-critical host. The age of the product lowers typical exposure, but confirmed exposure can mean server compromise. If Docmint is not in use, record non-applicability and move on. Mitigation focus: Identify and retire any Docmint 2.0 or earlier deployments.; Disable PHP register_globals where it exists.; Restrict public access to legacy Docmint systems until remediated..

Prepared

Jun 29, 2026, 10:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.