CVE-2005-0565

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-05-02 · updated 2026-06-16

Description

The Announce module in phpWebSite 0.10.0 and earlier allows remote attackers to execute arbitrary PHP code by setting the Image field to reference a PHP file whose name contains a .gif.php extension.

Affected products

Phpwebsite: 0.9.0, 0.9.1, 0.9.2, 0.9.2.1, 0.9.3, 0.9.3.1 (+4)

References

http://marc.info/?l=bugtraq&m=110928565530828&w=2
http://secunia.com/advisories/14399
http://securitytracker.com/id?1013298
http://www.gentoo.org/security/en/glsa/glsa-200503-04.xml
https://exchange.xforce.ibmcloud.com/vulnerabilities/19482
http://marc.info/?l=bugtraq&m=110928565530828&w=2
http://secunia.com/advisories/14399
http://securitytracker.com/id?1013298
http://www.gentoo.org/security/en/glsa/glsa-200503-04.xml
https://exchange.xforce.ibmcloud.com/vulnerabilities/19482

Get alerted when CVE-2005-0565 or the next vulnerability affects your stack