Read the docs
TI-2005-04212 Aliases CVE-2005-4469GHSA-q99f-3fh3-fpw2

Multiple direct static code injection vulnerabilities in PHPGedView 3.3.7 and earlier…

Priority LOW 38Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

Multiple direct static code injection vulnerabilities in PHPGedView 3.3.7 and earlier allow remote attackers to execute arbitrary PHP code via (1) the username field in login.php, or the (2) user_language, (3) user_email, and (4) user_gedcomid parameters in login_register.php, which is directly inserted into authenticate.php.

Why it matters now

EPSS 0.02661 85th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:phpgedview:phpgedview:*:*:*:*:*:*:*:*up to 3.3.7VulnerablePhpgedview
cpe:2.3:a:phpgedview:phpgedview:2.52.3:*:*:*:*:*:*:*2.52.3VulnerablePhpgedview
cpe:2.3:a:phpgedview:phpgedview:2.60:*:*:*:*:*:*:*2.60VulnerablePhpgedview
cpe:2.3:a:phpgedview:phpgedview:2.61:*:*:*:*:*:*:*2.61VulnerablePhpgedview
cpe:2.3:a:phpgedview:phpgedview:2.61.1:*:*:*:*:*:*:*2.61.1VulnerablePhpgedview
cpe:2.3:a:phpgedview:phpgedview:2.65:*:*:*:*:*:*:*2.65VulnerablePhpgedview
cpe:2.3:a:phpgedview:phpgedview:2.65.1:*:*:*:*:*:*:*2.65.1VulnerablePhpgedview
cpe:2.3:a:phpgedview:phpgedview:2.65.2:*:*:*:*:*:*:*2.65.2VulnerablePhpgedview
cpe:2.3:a:phpgedview:phpgedview:2.65_beta5:*:*:*:*:*:*:*2.65_beta5VulnerablePhpgedview
  • cpe:2.3:a:phpgedview:phpgedview:*:*:*:*:*:*:*:* Versions up to 3.3.7 Vulnerable ·Phpgedview
  • cpe:2.3:a:phpgedview:phpgedview:2.52.3:*:*:*:*:*:*:* Versions 2.52.3 Vulnerable ·Phpgedview
  • cpe:2.3:a:phpgedview:phpgedview:2.60:*:*:*:*:*:*:* Versions 2.60 Vulnerable ·Phpgedview
  • cpe:2.3:a:phpgedview:phpgedview:2.61:*:*:*:*:*:*:* Versions 2.61 Vulnerable ·Phpgedview
  • cpe:2.3:a:phpgedview:phpgedview:2.61.1:*:*:*:*:*:*:* Versions 2.61.1 Vulnerable ·Phpgedview
  • cpe:2.3:a:phpgedview:phpgedview:2.65:*:*:*:*:*:*:* Versions 2.65 Vulnerable ·Phpgedview
  • cpe:2.3:a:phpgedview:phpgedview:2.65.1:*:*:*:*:*:*:* Versions 2.65.1 Vulnerable ·Phpgedview
  • cpe:2.3:a:phpgedview:phpgedview:2.65.2:*:*:*:*:*:*:* Versions 2.65.2 Vulnerable ·Phpgedview
  • cpe:2.3:a:phpgedview:phpgedview:2.65_beta5:*:*:*:*:*:*:* Versions 2.65_beta5 Vulnerable ·Phpgedview

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2005-4469
  2. 2026-10-03 Alias added: GHSA-q99f-3fh3-fpw2

References

Exploit 1

Patch 2

Other 3

  • TI-2004-00019 PHP remote file inclusion vulnerability in (1) functions.php, (2)… CVSS 3.1CRITICAL 9.8
  • TI-2008-01984 Multiple unspecified vulnerabilities in PhpGedView before 4.1.5 have unknown impact and… CVSS 2.0HIGH 10.0
  • TI-2004-00111 PHP remote file inclusion vulnerability in the GEDCOM configuration script for phpGedView… CVSS 2.0HIGH 7.5
  • TI-2011-00340 Directory traversal vulnerability in module.php in PhpGedView 4.2.3 and possibly other… CVSS 2.0MEDIUM 6.8
  • TI-2004-00110 Directory traversal vulnerability in editconfig_gedcom.php for phpGedView 2.65.1 and… CVSS 2.0HIGH 7.5
  • TI-2004-00053 Multiple SQL injection vulnerabilities in phpGedView before 2.65 allow remote attackers… CVSS 2.0HIGH 7.5
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences