Summary
generated automatically from NVD dataIn the Apache module for PHP versions 4.0.0 through 4.0.4, setting 'engine = off' for one virtual host can unintentionally turn PHP off for other virtual hosts. As a result, Apache may serve the raw source code of PHP scripts instead of executing them, exposing their contents to remote users. NVD rates it 5.0 (MEDIUM, CVSS v2.0), with a confidentiality-only impact; Mandrake Linux 7.2 is also listed as affected.
NVD description
The Apache module for PHP 4.0.0 through PHP 4.0.4, when disabled with the 'engine = off' option for a virtual host, may disable PHP for other virtual hosts, which could cause Apache to serve the source code of PHP scripts.
EPSS · FIRST.org
1.6%probability of exploitation in the next 30 days
Higher than 75% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-30, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 12 janv. 2001
- Updated
- 16 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Bounds published by NVD: "< 8.4.27" means 8.4.27 is no longer vulnerable. The fixed release to install is in the vendor advisory.
Weaknesses (CWE)
References (14)
- http://www.iss.net/security_center/static/5939.phpPatchVendor Advisory
- http://www.iss.net/security_center/static/5939.phpPatchVendor Advisory
Similar CVEs
Other vulnerabilities of type
Running PHP servers? Know which CVEs hit your version.
Add the product and its version: cveo.tech lists the CVEs that affect it right away, then alerts you by email when a new one affects it — including before NVD has finished its analysis. Free, an account is all it takes.