Back to CVE Browser

CVE-2004-0128

HIGH

7.5

CVSS Severity Score

EPSS Score0.0420%

EPSS Percentile28.83th

PublishedMar 3, 2004

Last ModifiedApr 16, 2026

Vulnerability Description

PHP remote file inclusion vulnerability in the GEDCOM configuration script for phpGedView 2.65.1 and earlier allows remote attackers to execute arbitrary PHP code by modifying the PGV_BASE_DIRECTORY parameter to reference a URL on a remote web server that contains a malicious theme.php script.

Affected Platforms (CPE)

📦

Phpgedview

Phpgedview

= 2.52.3

📦

Phpgedview

Phpgedview

= 2.60

📦

Phpgedview

Phpgedview

= 2.61

📦

Phpgedview

Phpgedview

= 2.61.1

📦

Phpgedview

Phpgedview

= 2.65

📦

Phpgedview

Phpgedview

= 2.65.1

References & Advisories

🔗 http://secunia.com/advisories/10753/

🔗 http://sourceforge.net/project/shownotes.php?release_id=141517

🔗 http://www.osvdb.org/3769

🔗 http://www.securityfocus.com/archive/1/352355

🔗 http://www.securityfocus.com/bid/9531

🔗 https://exchange.xforce.ibmcloud.com/vulnerabilities/14987

🔗 http://secunia.com/advisories/10753/

🔗 http://sourceforge.net/project/shownotes.php?release_id=141517

Related Vulnerabilities

CVE-2008-206410.0

Multiple unspecified vulnerabilities in PhpGedView before 4.1.5 have unknown impact and attack vectors related to "a fundamental d...

CVE-2004-00309.8

PHP remote file inclusion vulnerability in (1) functions.php, (2) authentication_index.php, and (3) config_gedcom.php for PHPGEDVI...

CVE-2004-00317.5

PHPGEDVIEW 2.61 allows remote attackers to reinstall the software and change the administrator password via a direct HTTP request ...

CVE-2004-00657.5

Multiple SQL injection vulnerabilities in phpGedView before 2.65 allow remote attackers to execute arbitrary SQL via (1) timeline....