CVE-2010-1515

Published: Jun 15, 2010Modified: Apr 29, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS 2.0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) keyword or (2) article-id parameter in conjunction with a /admin/news/article/list PATH_INFO; the (3) keyword parameter in conjunction with a /admin/multimedia/set/list PATH_INFO; the (4) keyword or (5) fileId parameter in conjunction with a /admin/multimedia/file/list PATH_INFO; or the (6) name, (7) email, or (8) address parameter in conjunction with a /admin/ad/client/list PATH_INFO.

Affected (9)

Products: Tomatocms: Tomatocms

Tomatocms

1 product

Tomatocms

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Tomatocms Tomatocms	Up to 2.0.6
Tomatocms Tomatocms	Version 2.0.0
Tomatocms Tomatocms	Version 2.0.1
Tomatocms Tomatocms	Version 2.0.2
Tomatocms Tomatocms	Version 2.0.3.1430
Tomatocms Tomatocms	Version 2.0.3.1622
Tomatocms Tomatocms	Version 2.0.3
Tomatocms Tomatocms	Version 2.0.4
Tomatocms Tomatocms	Version 2.0.5