VULNERABILITY INTELLIGENCE
CVE-2011-4825
CVSS score7.5 HIGH
EPSS probability39.16%
CISA KEVNot currently listed
Published2011-12-15
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:N/C:P/I:P/A:P
Description
Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters.
Weakness classification
- CWE-94: Improper Control of Generation of Code ('Code Injection')