CVE-2005-1894

CVE-2005-1894 describes a direct code injection vulnerability in FlatNuke version 2.5.3. Remote attackers can execute arbitrary PHP code by embedding it within the Referer header of an HTTP request, which is then injected into the referer.php file and subsequently accessible to the attacker. This vulnerability carries a CVSS score of 7.5, indicating high severity due to its network-based attack vector, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. The FAUCET Risk Score is 93/100. While there is no evidence of active exploitation (KEV: No), exploit code is publicly available via ExploitDB (EDB-25801). There is minimal community discussion or media coverage surrounding this CVE.