CVE-2010-4607: Multiple cross-site scripting (XSS) vulnerabilities in Habari 0.6.5, when register_globals is enabled, allo...

Security readout for executives and security teams

This is an old Habari CMS cross-site scripting issue affecting Habari 0.6.5 when PHP register_globals is enabled. An attacker could inject script or HTML through specific admin dashboard parameters. Business risk depends on whether any legacy Habari 0.6.5 systems still exist and whether admin users can be reached by attacker-controlled content. Likely limited to legacy Habari 0.6.5 deployments running old PHP configurations where register_globals remains enabled. Internet-facing CMS administration paths, shared hosting remnants, or abandoned sites are the most plausible exposure points. Prioritize as a legacy exposure check, not an emergency unless Habari 0.6.5 is still reachable. If found on a public or business-critical site, retire or upgrade promptly because XSS can support session theft, content manipulation, and admin compromise. Mitigation focus: Inventory any Habari deployments and confirm exact version.; Disable register_globals where present, after compatibility review.; Restrict access to Habari administration paths..

Prepared

Jun 28, 2026, 01:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.