CVE-2007-2148: Direct static code injection vulnerability in admin/save.php in Stephen Craton (aka WiredPHP) Chatness 2.5....

Security readout for executives and security teams

Chatness 2.5.3 and earlier allowed an authenticated administrator to save content that could become server-executed PHP. In business terms, a compromised or malicious admin account could turn website template editing into server code execution. No source in the bundle confirms active exploitation. Exposure is likely limited to organizations still running Stephen Craton/WiredPHP Chatness 2.5.3 or earlier, especially where the admin interface is internet-accessible or administrator credentials are weak, shared, or compromised. Treat this as urgent only if Chatness is still present. The product is old, but the impact is serious because admin access could become server code execution. Unsupported internet-facing deployments should be retired or isolated quickly. Mitigation focus: Identify any deployed Chatness instances and confirm version.; Restrict Chatness administration to trusted networks and named administrators.; Review vendor or archived advisory guidance for fixed versions or retirement advice..

Prepared

Jun 29, 2026, 06:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.