CVE-2006-7173: Direct static code injection vulnerability in admin.php in PHP-Stats 0.1.9.1b and earlier allows remote att...

Security readout for executives and security teams

PHP-Stats versions 0.1.9.1b and earlier can let a remote attacker inject PHP code through the admin interface. If the generated options file is later loaded, that code may run on the server. The sources do not provide a CVSS score or confirmed active exploitation. Exposure is most likely on legacy websites still running PHP-Stats 0.1.9.1b or earlier, especially where admin.php is reachable from untrusted networks. The bundle does not identify maintained package names, CPEs, or affected platforms beyond PHP-Stats. Treat exposed legacy PHP-Stats instances as urgent cleanup. The likely business risk is server compromise from an old web component, but urgency depends on whether the product is still deployed and reachable. Mitigation focus: Inventory websites for PHP-Stats 0.1.9.1b or earlier.; Check vendor or advisory guidance for a fixed release or supported migration path.; Remove or isolate unsupported PHP-Stats deployments where no fix is available..

Prepared

Jun 29, 2026, 06:37 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.