CVE-2014-4663

TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter.

CVE-2011-4106

The TimThumb (timthumb.php) component, in versions prior to 2.0 , is vulnerable to remote code execution due to a design/logic flaw in source validation. The software fails to validate the entire source against its domain whitelist, allowing remote attackers to upload and execute arbitrary code. ...

CVE-2009-5142

Technical details of CVE-2009-5142 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2010-5303

CVE-2010-5303 describes a cross-site scripting (XSS) vulnerability in TimThumb before 1.15 (r85), specifically in the displayError function, where an attacker could inject arbitrary script/HTML via $errorString. Affected: TimThumb core used in multiple products. Impact: remote abuse of XSS. Mitig...

CVE-2010-5302

TimThumb vulnerability CVE-2010-5302 affects the timthumb.php component in TimThumb (versions before 1.15, as of 2010-09-08 r88). The root cause is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING. The affected software is ...