CVE-2010-3910

Published: Nov 26, 2010Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Multiple directory traversal vulnerabilities in the return_application_language function in include/utils/utils.php in vtiger CRM before 5.2.1 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in (1) the lang_crm parameter to phprint.php or (2) the current_language parameter in an Accounts Import action to graph.php.

Affected (24)

Products: Vtiger: Vtiger Crm

Vtiger

1 product

Vtiger Crm

Configuration A

24 vulnerable

Vulnerable Software	Affected Versions
Vtiger Vtiger Crm	Up to 5.2.0
Vtiger Vtiger Crm	Version 1.0
Vtiger Vtiger Crm	Version 2.0.1
Vtiger Vtiger Crm	Version 2.0
Vtiger Vtiger Crm	Version 2.1
Vtiger Vtiger Crm	Version 3.0
Vtiger Vtiger Crm	Version 3.0 beta
Vtiger Vtiger Crm	Version 3.2
Vtiger Vtiger Crm	Version 3
Vtiger Vtiger Crm	Version 4.0.1
Vtiger Vtiger Crm	Version 4.0
Vtiger Vtiger Crm	Version 4.2.4
Vtiger Vtiger Crm	Version 4.2
Vtiger Vtiger Crm	Version 4.2
Vtiger Vtiger Crm	Version 4
Vtiger Vtiger Crm	Version 4 beta
Vtiger Vtiger Crm	Version 4 rc1
Vtiger Vtiger Crm	Version 5.0.0
Vtiger Vtiger Crm	Version 5.0.2
Vtiger Vtiger Crm	Version 5.0.3
Vtiger Vtiger Crm	Version 5.0.4
Vtiger Vtiger Crm	Version 5.0.4 rc
Vtiger Vtiger Crm	Version 5.1.0
Vtiger Vtiger Crm	Version 5.1.0 rc