CVE-2005-3926: Guppy

High severity, CVSS 7.5. EPSS: 3.1% chance of exploitation in the next 30 days.

Direct static code injection vulnerability in error.php in GuppY 4.5.9 and earlier, when register_globals is disabled, allows remote attackers to execute arbitrary PHP code via the _SERVER[REMOTE_ADDR] parameter, which is injected into a .inc script that is later included by the main script.

Affected products

• Guppy Guppy: version 4.5 only; version 4.5.3 only; version 4.5.3a only; version 4.5.4 only; version 4.5.9 only

Published 2005-11-30. Last modified 2026-06-16.