How severe is CVE-2005-2699?

CVE-2005-2699 has a CVSS 2.0 base score of 4.6, rated medium severity.

Is CVE-2005-2699 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (38th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2005-2699?

CVE-2005-2699 affects Phpkit. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2005-2699?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2005-2699 published?

CVE-2005-2699 was published on 2005-08-26 and last updated on 2026-06-16.

CVE-2005-2699

CVE-2005-2699 is a medium-severity vulnerability in Phpkit with a CVSS 2.0 base score of 4.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 2.0 base score 4.6)
EPSS exploit prediction: 0% (38th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Phpkit
Published: 2005-08-26
Last modified: 2026-06-16

Description

Unrestricted file upload vulnerability in admin/admin.php in PHPKit 1.6.1 allows remote authenticated administrators to execute arbitrary PHP code by uploading a .php file to the content/images/ directory using images.php. NOTE: if a PHPKit administrator must already have access to the end system to install or modify configuration of the product, then this issue might not cross privilege boundaries, and should not be included in CVE.

Frequently asked questions

What is CVE-2005-2699?: Unrestricted file upload vulnerability in admin/admin.php in PHPKit 1.6.1 allows remote authenticated administrators to execute arbitrary PHP code by uploading a .php file to the content/images/ directory using images.php. NOTE: if a PHPKit administrator must already have access to the end system to install or modify configuration of the product, then this issue might not cross privilege boundaries, and should not be included in CVE.
How severe is CVE-2005-2699?: CVE-2005-2699 has a CVSS 2.0 base score of 4.6, rated medium severity.
Is CVE-2005-2699 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (38th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2005-2699?: CVE-2005-2699 affects Phpkit. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2005-2699?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2005-2699 published?: CVE-2005-2699 was published on 2005-08-26 and last updated on 2026-06-16.

References

http://marc.info/?l=bugtraq&m=112474427221031&w=2

Affected products (1)

cpe:2.3:a:phpkit:phpkit:1.6.1:*:*:*:*:*:*:*

More vulnerabilities in Phpkit

CVE-2016-10758 — High (CVSS 8.8): PHPKIT 1.6.6 allows arbitrary File Upload, as demonstrated by a .php file to pkinc/admin/mediaarchive.php and…
CVE-2007-6134 — High (CVSS 7.5): SQL injection vulnerability in pkinc/public/article.php in PHPKIT 1.6.4pl1 allows remote attackers to execute arbitrary…
CVE-2006-7115 — High (CVSS 7.5): SQL injection vulnerability in PHPKit 1.6.1 RC2 allows remote attackers to inject arbitrary SQL commands via the catid…
CVE-2007-0179 — High (CVSS 7.5): SQL injection vulnerability in comment.php in PHPKIT 1.6.1 R2 allows remote attackers to execute arbitrary SQL commands…
CVE-2005-3553 — High (CVSS 7.5): Multiple SQL injection vulnerabilities in include.php in PHPKIT 1.6.1 R2 and earlier allow remote attackers to execute…
CVE-2005-2683 — High (CVSS 7.5): Multiple SQL injection vulnerabilities in PHPKit 1.6.1 allow remote attackers to execute arbitrary SQL commands via the…

All CVEs affecting Phpkit →