CVE-2009-1677: Multiple static code injection vulnerabilities in the saveFeed function in rss/feedcreator.class.php in Bit...

Security readout for executives and security teams

CVE-2009-1677 is a legacy Bitweaver issue where attacker-controlled text can be written into server-side files as PHP code. Confirmed exposure requires an authenticated user changing their display name, then triggering the boards RSS page. A second Host-header path is described as possible, not confirmed. Exposure is likely limited to legacy Bitweaver 2.6 or earlier installations with boards/boards_rss.php reachable and feed generation enabled. The source bundle has no CPE detail and lists affected vendor/product as n/a, so asset identification needs local confirmation. Prioritize remediation if any internet-facing Bitweaver 2.6 or older instance remains in use. The vulnerability can lead to server-side code execution, but evidence points to old, specific software and no confirmed active exploitation in the supplied sources. Mitigation focus: Inventory Bitweaver installations and confirm whether any are version 2.6 or earlier.; Check current Bitweaver or vendor guidance for the supported fix or upgrade path.; Restrict or disable boards/boards_rss.php until exposure is understood..

Prepared

Jun 28, 2026, 10:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.