CVE-2006-5251: PHP remote file inclusion vulnerability in index.php in Deep CMS 2.0a allows remote attackers to execute ar...

Security readout for executives and security teams

This is an old reported issue in Deep CMS 2.0a where a web request could point a configuration path at a remote URL. If true and reachable, that could let an attacker run PHP code on the server. The record warns the provenance is unknown, so treat it as a serious legacy exposure that needs verification. Exposure is likely limited to organizations still running Deep CMS 2.0a or derivative code with the affected index.php behavior. Public internet exposure would raise urgency. The source bundle does not provide CPEs or a definitive vendor-maintained affected-products list. Prioritize verification if Deep CMS is present, especially on public-facing servers. The business risk is potential server compromise, but confidence is reduced because the public record lacks vendor confirmation, scoring, and detailed affected-product metadata. Mitigation focus: Identify and retire any Deep CMS 2.0a instances where possible.; Check vendor or archived project guidance for any official fix.; Restrict public access to legacy Deep CMS deployments during verification..

Prepared

Jun 29, 2026, 10:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.