CVE-2011-4825: Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before…

Description

Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters.

Exploitation

Is it being used?

Exploit prediction (EPSS)39.2% · higher than 99% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AF

Ajax File And Image Manager · Phpletter

through 1.0; 0.5; 0.5.5; 0.5.7; 0.6; 0.6.12; +14 more · source: NVD

PH

Phpmyfaq · Phpmyfaq

2.6.0; 2.6.1; 2.6.2; 2.6.3; 2.6.4; 2.6.5; +14 more · source: NVD

TI

Tinymce · Tinymce

through 1.4.1 · source: NVD