CVE-2007-3221: PHP remote file inclusion vulnerability in admin/spaw/spaw_control.class.php in the XT-Conteudo module for...

Security readout for executives and security teams

CVE-2007-3221 describes a remote file inclusion flaw in the XT-Conteudo module for XOOPS. A vulnerable site could be tricked into loading attacker-controlled PHP, potentially leading to server-side code execution. The record notes this is probably a duplicate of CVE-2006-4656. Exposure is most likely limited to legacy XOOPS deployments using the XT-Conteudo module with the referenced SPAW control file. The supplied affected-product metadata is incomplete, so asset confirmation must be file- and application-based. Prioritize if any public-facing legacy XOOPS site uses XT-Conteudo. The business risk is potential server compromise, but urgency depends on confirmed deployment because source metadata is incomplete. Mitigation focus: Check vendor or maintainer guidance for XT-Conteudo and XOOPS before applying fixes.; Remove or disable the XT-Conteudo module if it is unused.; Restrict public access to administrative PHP paths where operationally possible..

Prepared

Jun 29, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.