CVE-2007-3118: Multiple PHP remote file inclusion vulnerabilities in Kravchuk letter (K-letter) 1.0 allow remote attackers...

Security readout for executives and security teams

Kravchuk letter (K-letter) 1.0 has multiple remote file inclusion flaws. An internet attacker could make the application load attacker-controlled PHP through the scdir parameter, potentially taking control of the web application context. Exposure is likely limited to legacy sites still running K-letter 1.0, especially if the affected PHP files are publicly reachable. Evidence does not identify broader products or versions. Prioritize remediation for any public-facing installation. The business risk is legacy web compromise, but urgency depends on whether K-letter 1.0 is actually present and reachable. Mitigation focus: Inventory websites for K-letter 1.0 or Kravchuk letter installations.; Remove or replace unsupported K-letter deployments where possible.; Restrict public access to affected PHP files if removal is delayed..

Prepared

Jun 29, 2026, 05:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.