CVEvulnerability

CVE-2010-1514

6.0 MEDIUM Published 2010-06-15 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2010-06-15
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P

Description

Unrestricted file upload vulnerability in TomatoCMS 2.0.6 and earlier allows remote authenticated users, with certain privileges, to execute arbitrary PHP code by uploading an image file, and then accessing it via a direct request to the file in an unspecified directory.

Affected configurations

• tomatocms tomatocms (<= 2.0.6) • tomatocms tomatocms 2.0.0 • tomatocms tomatocms 2.0.1 • tomatocms tomatocms 2.0.2 • tomatocms tomatocms 2.0.3 • tomatocms tomatocms 2.0.3.1430 • tomatocms tomatocms 2.0.3.1622 • tomatocms tomatocms 2.0.4 • tomatocms tomatocms 2.0.5

References