CVE-2007-2205: PHP remote file inclusion vulnerability in modules/rtmessageadd.php in LAN Management System (LMS) 1.5.3, a...

Security readout for executives and security teams

This old LMS vulnerability could let an unauthenticated remote attacker make the application include attacker-controlled PHP code. If an affected LMS instance is still reachable, the business impact could be full compromise of that web application. The source bundle does not provide CVSS, a confirmed patch, or evidence of active exploitation. Exposure is most likely in legacy LMS 1.5.3 deployments, with possible 1.5.4 exposure. Risk depends on whether modules/rtmessageadd.php is present and web-accessible. Modern environments are unlikely affected unless they retain this old application or forked code. Prioritize verification if LMS is internet-facing or business-critical. The vulnerability is old, but the described impact is server-side code execution. If no deployment exists, document non-exposure and close with low residual risk. Mitigation focus: Identify and retire unsupported LMS 1.5.3 deployments where possible.; Check LMS or vendor archives for fixed-version guidance before upgrading.; Remove public access to affected LMS instances until validated..

Prepared

Jun 29, 2026, 06:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.