CVE-2007-0986: PHP remote file inclusion vulnerability in index.php in Jupiter CMS 1.1.5, when PHP 5.0.0 or later is used,...

Security readout for executives and security teams

This is a legacy Jupiter CMS issue where a remote attacker could make the site include and run PHP code from an FTP URL. If an exposed Jupiter CMS 1.1.5 site still exists, compromise could mean full control of that web application. Likely limited to legacy Jupiter CMS 1.1.5 deployments running PHP 5.0.0 or later and exposing index.php. The source bundle has no usable CPEs or vendor/product metadata, so exposure must be confirmed through asset inventory and code or deployment review. Prioritize confirmation if legacy Jupiter CMS may still be online. The business risk is high for exposed instances because successful exploitation could execute attacker-controlled PHP code, but likely scope is narrow and tied to old, specific deployments. Mitigation focus: Identify and retire any remaining Jupiter CMS 1.1.5 installations.; Check vendor or project guidance; no patch is named in the provided sources.; Restrict public access to affected legacy endpoints during review..

Prepared

Jun 29, 2026, 07:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.