CVE-2009-3949: cp/profile.php in VivaPrograms Infinity 2.0.5 and earlier does not require administrative authentication fo...

Security readout for executives and security teams

CVE-2009-3949 affects VivaPrograms Infinity 2.0.5 and earlier. A specific control-panel profile function does not require administrator login, allowing a remote attacker to create administrator accounts. This is serious where the application is still reachable, but current exposure is likely limited to legacy deployments. Organizations are exposed if they still run VivaPrograms Infinity 2.0.5 or earlier, especially if cp/profile.php is internet-accessible. The source bundle does not identify other affected products or supported fixed versions. Prioritize remediation if any affected Infinity instance is internet-facing or used for business operations. The vulnerability can lead directly to administrative takeover. If the product is absent, no action is needed beyond documentation. Mitigation focus: Identify any VivaPrograms Infinity installations and versions.; Restrict public access to the control panel immediately where possible.; Check vendor or archival project guidance for fixed versions or official workarounds..

Prepared

Jun 28, 2026, 17:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.