CVE-2014-4663

TimThumb 2.8.13 and WordThumb 1.07, when Webshot (aka Webshots) is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter.

CVE-2011-4106

The TimThumb (timthumb.php) component, in versions prior to 2.0 , is vulnerable to remote code execution due to a design/logic flaw in source validation. The software fails to validate the entire source against its domain whitelist, allowing remote attackers to upload and execute arbitrary code. ...