CVE-2007-2985: Pheap 2.0 allows remote attackers to bypass authentication by setting a pheap_login cookie value to the adm...

Security readout for executives and security teams

CVE-2007-2985 affects Pheap 2.0. The reported flaw lets a remote attacker bypass login by controlling a cookie, potentially exposing administrator settings and enabling PHP code execution. That combination can lead to full compromise of the application host if the software is internet-facing. Exposure is most likely on legacy websites still running Pheap 2.0, especially if settings.php or edit.php are reachable from the internet. The bundle does not identify vendor CPEs or broader affected versions. Prioritize urgently if Pheap 2.0 is present. The issue combines login bypass, sensitive credential exposure, and possible server-side code execution, which can create direct business risk for any exposed legacy site. Mitigation focus: Identify and remove any internet-facing Pheap 2.0 deployments.; Check current vendor or maintainer guidance for any available fix.; Restrict access to administrative PHP endpoints until remediation is complete..

Prepared

Jun 29, 2026, 05:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.