← Vulnerability feed

Vulnerability record · CVE-2005-1137 · published 2 May 2005

CVE-2005-1137: Alexander palmo simple php blog vulnerability

AAlexander Palmo · Simple Php Blog

Simple PHP Blog (sphpBlog) 0.4.0 allows remote attackers to obtain sensitive information via a direct request to sb_functions.php, which leaks the full pathname in a PHP error message.

5.0 CVSS 2.0 Medium EPSS 1.3% · top 30.6%
5.0CVSS 2.0 base score
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

Simple PHP Blog (sphpBlog) 0.4.0 allows remote attackers to obtain sensitive information via a direct request to sb_functions.php, which leaks the full pathname in a PHP error message.

AV:N/AC:L/Au:N/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://echo.or.id/adv/adv12-y3dips-2005.txt Exploit
http://marc.info/?l=bugtraq&m=111359320312609&w=2
http://echo.or.id/adv/adv12-y3dips-2005.txt Exploit
http://marc.info/?l=bugtraq&m=111359320312609&w=2

Track CVE-2005-1137 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2007-5071Alexander palmo simple php blog vulnerabilityIncomplete blacklist vulnerability in upload_img_cgi.php in Simple PHP Blog before 0.5.1 allows remote attackers to upload dangerous files and execut…EPSS 3.0%7.5CVE-2006-1243Alexander palmo simple php blog vulnerabilityDirectory traversal vulnerability in install05.php in Simple PHP Blog (SPB) 0.4.7.1 and earlier allows remote attackers to include and execute arbitr…EPSS 9.7%7.5CVE-2005-2733Simple PHP Blog upload_img_cgi.php unrestricted file extension uploadupload_img_cgi.php in Simple PHP Blog (SPHPBlog) fails to properly restrict the file extensions of uploaded files. Because uploaded files are not val…EPSS 51%analysed6.5CVE-2009-4421Alexander palmo simple php blog path traversal vulnerabilityDirectory traversal vulnerability in languages_cgi.php in Simple PHP Blog 0.5.1 and earlier allows remote authenticated users to include and execute …EPSS 2.0%5.0CVE-2005-2787Alexander palmo simple php blog vulnerabilitycomment_delete_cgi.php in Simple PHP Blog allows remote attackers to delete arbitrary files via the comment parameter.EPSS 5.6%5.0CVE-2005-2192Alexander palmo simple php blog vulnerabilitySimplePHPBlog 0.4.0 stores password hashes in config/password.txt with insufficient access control, which allows remote attackers to obtain passwords…EPSS 4.1%5.0CVE-2005-0214Alexander palmo simple php blog vulnerabilityDirectory traversal vulnerability in Simple PHP Blog (SPHPBlog) 0.3.7c allows remote attackers to read or create arbitrary files via a .. (dot dot) i…EPSS 1.7%4.3CVE-2011-5029Alexander palmo simple php blog cross-site scripting vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in Simple PHP Blog 0.7.0 and possibly earlier allow remote attackers to inject arbitrary web scri…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2005-1137), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.