CVE-2008-5204: Multiple directory traversal vulnerabilities in PowerAward 1.1.0 RC1, when register_globals is enabled, all...

Security readout for executives and security teams

PowerAward 1.1.0 RC1 can let a remote attacker make the application load unintended local files through its language parameter, but only when PHP register_globals is enabled. If this old application is still internet-facing, the business risk is meaningful because the CVE says included local files may execute. Exposure is most likely in legacy PowerAward 1.1.0 RC1 installations running old PHP configurations with register_globals enabled and public access to the listed PHP endpoints. Treat this as urgent only if PowerAward 1.1.0 RC1 is still deployed. The technology and prerequisite are old, so many environments will have no exposure, but exposed legacy instances should be contained quickly. Mitigation focus: Identify any PowerAward 1.1.0 RC1 deployments and owners.; Disable register_globals where present; the CVE condition depends on it.; Restrict or remove public access until remediation is confirmed..

Prepared

Jun 28, 2026, 11:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.