CVE-2008-3313: Multiple PHP remote file inclusion vulnerabilities in CreaCMS 1.0 allow remote attackers to execute arbitra...

Security readout for executives and security teams

CVE-2008-3313 describes reported remote file inclusion flaws in CreaCMS 1.0. If a vulnerable site is reachable, an attacker may be able to make the PHP application load remote code and execute arbitrary PHP. The record warns that the provenance is unknown and details come only from third-party information. Exposure appears limited to CreaCMS 1.0 deployments where the named administration PHP files are present and reachable. The CVE record does not provide CPEs or broader affected product data, so asset confirmation is required. Treat confirmed internet-facing CreaCMS 1.0 as urgent because the reported impact is arbitrary PHP execution. Priority is lower if no CreaCMS assets exist. Evidence quality is limited, so focus first on fast inventory and exposure confirmation. Mitigation focus: Inventory and remove any unsupported CreaCMS 1.0 deployments.; Check vendor or archived project guidance for an official fix.; Restrict public access to the named administration paths during assessment..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.