CVE-2005-0679: Stadtaus Tell A Friend Script

High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days.

PHP remote file inclusion vulnerability in tell_a_friend.inc.php for Tell A Friend Script 2.7 before 20050305 allows remote attackers to execute arbitrary PHP code by modifying the script_root parameter to reference a URL on a remote web server that contains the code. NOTE: it was later reported that 2.4 is also affected.

Affected products

• Stadtaus Tell A Friend Script: up to and including 2.7

Published 2005-05-02. Last modified 2026-06-16.