CVE-2004-2538 json
Direct static code injection vulnerability in the PCG simple application generation in phpCodeGenie before 3.0.2 allows remote authenticate…
published 2004-12-31 21 y ago modified 2026-06-16 4 mo ago also EUVD-2004-2529
- cvss
- 6.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.3%
- EPSS 2.3% chance of exploitation in 30 days, percentile 83%
- public exploits
- 0
- none known
Summary
Direct static code injection vulnerability in the PCG simple application generation in phpCodeGenie before 3.0.2 allows remote authenticated users to execute arbitrary code via the (1) header or (2) footer.
Patch / fix
- securitytracker.com/id?1011911 patch
- securityfocus.com/bid/11524 patch
- secunia.com/advisories/12853 advisory
Exploit prediction
2.29% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
References
-
securitytracker.com
/id?1011911
vdb-entry, patch
-
secunia.com
/advisories/12853
third-party-advisory, patch, vendor-advisory
-
securityfocus.com
/bid/11524
vdb-entry, patch
- phpcodegenie.sourceforge.net /phpCodeGenie/docs/ChangeLog.txt
-
osvdb.org
/11102
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/17848
vdb-entry
Sources
- CVE List CVE-2004-2538
- NVD CVE-2004-2538
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.