CVE-2010-1995

2010-05-2017:00:00

mitre

www.cve.org

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.7%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with “Add new article” privileges, to inject arbitrary web script or HTML via the (1) title, (2) subTitle, and (3) author parameters in conjunction with a /admin/news/article/add PATH_INFO.

References

holisticinfosec.org/content/view/141/45/

osvdb.org/64550

secunia.com/advisories/39320

secunia.com/secunia_research/2010-59/

www.securityfocus.com/archive/1/511272/100/0/threaded

www.securityfocus.com/bid/40108

exchange.xforce.ibmcloud.com/vulnerabilities/58471