CVE-2007-1640: Multiple PHP remote file inclusion vulnerabilities in ClassWeb 2.03 and earlier allow remote attackers to e...

Security readout for executives and security teams

CVE-2007-1640 affects ClassWeb 2.03 and earlier. The vulnerable PHP pages can be tricked into loading attacker-controlled code through the BASE parameter, which could let an attacker run code on the web server. The source bundle names public exploit material, but does not show active exploitation or an official fix. Exposure is most likely where legacy ClassWeb 2.03 or earlier remains deployed and the affected PHP files are reachable from untrusted networks, especially the internet. Modern environments are only exposed if they still host this old application or copied vulnerable code. Prioritize any internet-facing ClassWeb instance for containment or retirement. Although the product is old and active exploitation is not evidenced here, the described impact is remote code execution and public exploit material is listed. Mitigation focus: Inventory for ClassWeb 2.03 or earlier installations.; Check vendor or archive guidance for an official fixed release.; Remove or retire unsupported ClassWeb deployments where possible..

Prepared

Jun 29, 2026, 06:37 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.