PHP remote file inclusion vulnerability in secure.php in PHPSecurePages (phpSP) 0.28beta…
Priority MEDIUM 41Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
PHP remote file inclusion vulnerability in secure.php in PHPSecurePages (phpSP) 0.28beta and earlier allows remote attackers to execute arbitrary code via the cfgProgDir parameter, a variant of CVE-2001-1468.
Why it matters now
EPSS 0.04937 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:secure_reality:phpsecurepages:0.11_beta:*:*:*:*:*:*:* | 0.11_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.12_beta:*:*:*:*:*:*:* | 0.12_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.13_beta:*:*:*:*:*:*:* | 0.13_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.14_beta:*:*:*:*:*:*:* | 0.14_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.15_beta:*:*:*:*:*:*:* | 0.15_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.16_beta:*:*:*:*:*:*:* | 0.16_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.17_beta:*:*:*:*:*:*:* | 0.17_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.18_beta:*:*:*:*:*:*:* | 0.18_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.19_beta:*:*:*:*:*:*:* | 0.19_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.20_beta:*:*:*:*:*:*:* | 0.20_beta | Vulnerable | Secure Reality |
- cpe:2.3:a:secure_reality:phpsecurepages:0.11_beta:*:*:*:*:*:*:* Versions 0.11_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.12_beta:*:*:*:*:*:*:* Versions 0.12_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.13_beta:*:*:*:*:*:*:* Versions 0.13_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.14_beta:*:*:*:*:*:*:* Versions 0.14_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.15_beta:*:*:*:*:*:*:* Versions 0.15_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.16_beta:*:*:*:*:*:*:* Versions 0.16_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.17_beta:*:*:*:*:*:*:* Versions 0.17_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.18_beta:*:*:*:*:*:*:* Versions 0.18_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.19_beta:*:*:*:*:*:*:* Versions 0.19_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.20_beta:*:*:*:*:*:*:* Versions 0.20_beta Vulnerable ·Secure Reality
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:secure_reality:phpsecurepages:0.21_beta:*:*:*:*:*:*:* | 0.21_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.22_beta:*:*:*:*:*:*:* | 0.22_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.23_beta:*:*:*:*:*:*:* | 0.23_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.24_beta:*:*:*:*:*:*:* | 0.24_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.25_beta:*:*:*:*:*:*:* | 0.25_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.26_beta:*:*:*:*:*:*:* | 0.26_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.27_beta:*:*:*:*:*:*:* | 0.27_beta | Vulnerable | Secure Reality |
| cpe:2.3:a:secure_reality:phpsecurepages:0.28_beta:*:*:*:*:*:*:* | 0.28_beta | Vulnerable | Secure Reality |
- cpe:2.3:a:secure_reality:phpsecurepages:0.21_beta:*:*:*:*:*:*:* Versions 0.21_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.22_beta:*:*:*:*:*:*:* Versions 0.22_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.23_beta:*:*:*:*:*:*:* Versions 0.23_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.24_beta:*:*:*:*:*:*:* Versions 0.24_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.25_beta:*:*:*:*:*:*:* Versions 0.25_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.26_beta:*:*:*:*:*:*:* Versions 0.26_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.27_beta:*:*:*:*:*:*:* Versions 0.27_beta Vulnerable ·Secure Reality
- cpe:2.3:a:secure_reality:phpsecurepages:0.28_beta:*:*:*:*:*:*:* Versions 0.28_beta Vulnerable ·Secure Reality
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2005-2251
- 2026-10-03 Alias added: GHSA-m7vf-xmj4-6gm7
References
Exploit 1
More Secure Reality Phpsecurepages vulnerabilities
- TI-2001-01420 PHP remote file inclusion vulnerability in checklogin.php in phpSecurePages 0.24 and… CVSS 2.0HIGH 7.5
Sources
- CVE-2005-2251 · CVE Program
- CVE-2005-2251 · NVD
- FIRST EPSS
- GHSA-m7vf-xmj4-6gm7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences