CVE-2002-1435: Achievo

High severity, CVSS 7.5. EPSS: 6.8% chance of exploitation in the next 30 days.

class.atkdateattribute.js.php in Achievo 0.7.0 through 0.9.1, except 0.8.2, allows remote attackers to execute arbitrary PHP code when the 'allow_url_fopen' setting is enabled via a URL in the config_atkroot parameter that points to the code.

Affected products

• Achievo Achievo: version 0.7.0 only; version 0.7.1 only; version 0.7.2 only; version 0.7.3 only; version 0.8.0 only; version 0.8.0_rc1 only; …

Published 2003-04-11. Last modified 2026-06-16.