What’s Vulnerable › Vulnerabilities

CVE-2005-2540

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2005-08-10 · updated 2026-06-16

Description

CRLF injection vulnerability in FlatNuke 2.5.5 and possibly earlier versions allows remote attackers to execute arbitrary PHP commands via an ASCII char 13 (carriage return) in the signature field, which is injected into a PHP script without a preceding comment character, which can then be executed by a direct request.

Affected products

• Flatnuke: 2.5.5

References

• http://marc.info/?l=bugtraq&m=112327238030127&w=2
• http://secunia.com/advisories/16330
• http://www.osvdb.org/18554
• http://www.rgod.altervista.org/flatnuke.html
• http://www.securityfocus.com/bid/14485
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21709
• http://marc.info/?l=bugtraq&m=112327238030127&w=2
• http://secunia.com/advisories/16330
• http://www.osvdb.org/18554
• http://www.rgod.altervista.org/flatnuke.html
• http://www.securityfocus.com/bid/14485
• https://exchange.xforce.ibmcloud.com/vulnerabilities/21709

Get alerted when CVE-2005-2540 or the next vulnerability affects your stack