CVE-2012-10054

🗓️ 13 Aug 2025 20:54:39Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 57 Views🌐 WEB

Umbraco before 4.7.1 unauth remote code via codeEditorSave.asmx SaveDLRScript; path traversal.

Reporter	Title	Published	Views	Family All 12
attackerkb	CVE-2012-10054	13 Aug 202520:54	–	attackerkb
Circl	CVE-2012-10054	29 May 201815:50	–	circl
CNNVD	Umbraco CMS security vulnerabilities	13 Aug 202500:00	–	cnnvd
Cvelist	CVE-2012-10054 Umbraco CMS < 4.7.1 codeEditorSave.asmx RCE	13 Aug 202520:54	–	cvelist
EUVD	EUVD-2012-6600	7 Oct 202500:30	–	euvd
Mend	CVE-2012-10054	13 Aug 202520:54	–	mend
Metasploit	Umbraco CMS Remote Command Execution	28 Jun 201200:00	–	metasploit
NVD	CVE-2012-10054	13 Aug 202521:15	–	nvd
Positive Technologies	PT-2025-33089 · Unknown · Umbraco Cms	13 Aug 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2012-10054: Unrestricted Upload of File with Dangerous Type	13 Aug 202500:00	–	rapid7

NVD

Vulners

CNA

Node

umbraco umbraco_cmsRange<4.7.1

[
  {
    "defaultStatus": "unknown",
    "modules": [
      "codeEditorSave.asmx SOAP endpoint"
    ],
    "product": "CMS",
    "vendor": "Umbraco",
    "versions": [
      {
        "lessThan": "4.7.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
raw	www.raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/umbraco_upload_aspx.rb
vulncheck	www.vulncheck.com/advisories/umbraco-cms-rce
github	www.github.com/umbraco/Umbraco-CMS
web	www.web.archive.org/web/20120707033729/http://blog.gdssecurity.com/labs/2012/7/3/find-bugs-faster-with-a-webmatrix-local-reference-instance.html
exploit-db	www.exploit-db.com/exploits/19671
web	www.web.archive.org/web/20111017174609/http://umbraco.codeplex.com/releases/view/73692

Parameter	Position	Path	Description	CWE
fileName	request body	/webservices/codeEditorSave.asmx	Unauthenticated remote code execution via the SaveDLRScript operation. A path traversal flaw in the fileName parameter allows uploading malicious ASPX scripts to the web-accessible /umbraco/ directory.	CWE-22, CWE-434
fileContents	request body	/webservices/codeEditorSave.asmx	Unauthenticated remote code execution via the SaveDLRScript operation. A path traversal flaw in the fileName parameter allows uploading malicious ASPX scripts to the web-accessible /umbraco/ directory.	CWE-22, CWE-434

16 Jun 2026 23:38Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.19.8

CVSS 49.3

EPSS0.04034

SSVC