Description

Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters.

Remediation

References

CVE-2011-4825

Related Vulnerabilities

MyBB Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-5908)

Liferay DXP Other Vulnerability (CVE-2023-33947)

WordPress Plugin Availability Calendar Cross-Site Scripting (1.2.1)

WordPress Plugin Campaign URL Builder Cross-Site Scripting (1.8.1)

WordPress Plugin EDD Favorites Cross-Site Scripting (1.0.6)

Severity

High

Classification

CVE-2011-4825 CWE-94

Tags

Missing Update Known Vulnerabilities