CVE-2007-1576: Multiple cross-site scripting (XSS) vulnerabilities in PHProjekt 5.2.0, when magic_quotes_gpc is disabled,...

Security readout for executives and security teams

PHProjekt 5.2.0 had multiple authenticated cross-site scripting issues when PHP magic_quotes_gpc was disabled. A logged-in attacker could inject script or HTML into several collaboration modules. Business urgency depends on whether this legacy application is still deployed, reachable, and used with sensitive project, contact, helpdesk, mail, or notes data. Exposure is likely limited to organizations still running PHProjekt 5.2.0, especially internet-facing or broadly accessible instances with authenticated users. The bundle does not identify affected CPEs or later versions. Treat as a legacy exposure cleanup item unless PHProjekt 5.2.0 is still reachable and business-critical. If present, prioritize remediation because authenticated XSS can undermine user trust, session integrity, and sensitive collaboration data. Mitigation focus: Inventory for PHProjekt 5.2.0 instances and determine whether they are still business-relevant.; Check PHProjekt and distribution guidance for the appropriate fixed version or retirement path.; Restrict access to trusted users and networks while remediation is evaluated..

Prepared

Jun 29, 2026, 06:37 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.