CVE-2007-3237: PHP remote file inclusion vulnerability in admin/spaw/spaw_control.class.php in the TinyContent 1.5 module...

Security readout for executives and security teams

This is an old XOOPS TinyContent 1.5 issue where a web-accessible PHP file may be tricked into loading attacker-controlled code. If an exposed site still runs the vulnerable module, compromise could mean server-side code execution. The source bundle does not identify a current patch. Exposure is most likely in legacy XOOPS installations with the TinyContent 1.5 module installed and the admin/spaw path reachable over HTTP. The bundle’s structured affected-product fields are incomplete, so confirm by inventory and file presence rather than CPE matching. Prioritize if any public-facing XOOPS site still uses TinyContent 1.5. The issue is old, but the impact is server compromise and public exploit material exists. If the module is absent, business urgency is low. Mitigation focus: Inventory XOOPS sites for TinyContent 1.5 and the SPAW admin component.; Disable or remove TinyContent 1.5 where it is not required.; Restrict web access to admin/spaw paths pending vendor-confirmed remediation..

Prepared

Jun 29, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.