CVEvulnerability
CVE-2010-1995
2.1 LOW
Official page ↗
- Status
- Modified
- Published
- 2010-05-20
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:N/AC:H/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with "Add new article" privileges, to inject arbitrary web script or HTML via the (1) title, (2) subTitle, and (3) author parameters in conjunction with a /admin/news/article/add PATH_INFO.
Affected configurations
• tomatocms tomatocms (<= 2.0.4)
• tomatocms tomatocms 2.0.0
• tomatocms tomatocms 2.0.1
• tomatocms tomatocms 2.0.2
• tomatocms tomatocms 2.0.3
• tomatocms tomatocms 2.0.3.1430
• tomatocms tomatocms 2.0.3.1622
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://holisticinfosec.org/content/view/141/45/ holisticinfosec.org
- http://osvdb.org/64550 osvdb.org
- http://secunia.com/advisories/39320 Vendor Advisory
- http://secunia.com/secunia_research/2010-59/ Vendor Advisory
- http://www.securityfocus.com/archive/1/511272/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/40108 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58471 exchange.xforce.ibmcloud.com
- http://holisticinfosec.org/content/view/141/45/ holisticinfosec.org
- http://osvdb.org/64550 osvdb.org
- http://secunia.com/advisories/39320 Vendor Advisory
- http://secunia.com/secunia_research/2010-59/ Vendor Advisory
- http://www.securityfocus.com/archive/1/511272/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/40108 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/58471 exchange.xforce.ibmcloud.com