CVE-2007-1060: Multiple PHP remote file inclusion vulnerabilities in Interspire SendStudio 2004.14 and earlier, when regis...

Security readout for executives and security teams

This is an old flaw in Interspire SendStudio 2004.14 and earlier. Under unsafe PHP configuration, an attacker could make the application load attacker-controlled PHP through ROOTDIR and run code on the server. The bundle does not show current exploitation, but exposed legacy installations would carry serious compromise risk. Exposure is likely limited to legacy Interspire SendStudio 2004.14 or earlier deployments with the vulnerable admin include files reachable and the named PHP settings enabled. Organizations should assume externally reachable installations are high risk until configuration and version are verified. Prioritize discovery and removal if any legacy SendStudio instance is internet-facing. The product age and remote code execution impact make continued exposure hard to justify, even without confirmed active exploitation in the provided sources. Mitigation focus: Inventory any Interspire SendStudio or legacy SendStudio installations.; Remove or isolate versions 2004.14 and earlier from internet exposure.; Check vendor guidance for the supported fixed version or migration path..

Prepared

Jun 29, 2026, 07:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.