CVE-2007-2364: Multiple PHP remote file inclusion vulnerabilities in burnCMS 0.2 and earlier allow remote attackers to exe...

Security readout for executives and security teams

burnCMS 0.2 and earlier has multiple remote file inclusion flaws. If an exposed vulnerable installation accepts attacker-controlled remote PHP through the documented parameter, the attacker may run code in the web application context. This is mainly a legacy-software risk. Exposure is likely limited to organizations still running burnCMS 0.2 or earlier, especially if internet-facing PHP files from lib/ or lib/db/ are reachable. Asset inventories may miss this because the affected metadata is sparse. Prioritize remediation if any burnCMS instance is reachable from the internet. The product appears old and the flaw enables code execution, so retention risk is hard to justify unless a verified business owner exists. Mitigation focus: Identify and retire any burnCMS 0.2 or earlier installations.; Check vendor or archive guidance for any supported upgrade path.; Restrict external access while ownership and remediation are confirmed..

Prepared

Jun 29, 2026, 05:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.