CVE-2011-4906

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

Tiny browser in TinyMCE 3.0 editor in Joomla! before 1.5.13 allows file upload and arbitrary PHP code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
Joomla!	Tiny browser included with TinyMCE 3.0	1.5.12; fixed in 1.5.13

References

https://developer.joomla.org/security/news/301-20090722-core-file-upload.htmlVendor Advisory
https://www.exploit-db.com/exploits/10183Exploit, Third Party Advisory, VDB Entry
https://www.openwall.com/lists/oss-security/2011/12/25/7Mailing List, Third Party Advisory
https://developer.joomla.org/security/news/301-20090722-core-file-upload.htmlVendor Advisory
https://www.exploit-db.com/exploits/10183Exploit, Third Party Advisory, VDB Entry
https://www.openwall.com/lists/oss-security/2011/12/25/7Mailing List, Third Party Advisory

Timeline

Published: Feb 12, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-49075.3Joomla! 1.5x through 1.5.12: Missing JEXEC Check CVE-2011-49089.8TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.CVE-2011-49094.3Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.5.12 allow remote attackers to inject arbitrary web script or HTML v CVE-2011-49104.3Cross-site scripting (XSS) vulnerability in Joomla! before 1.5.12 allows remote attackers to inject arbitrary web script or HTML via the PAT CVE-2011-49115.0Joomla! before 1.5.12 does not perform a JEXEC check in unspecified files, which allows remote attackers to obtain the installation path via CVE-2011-49125.3Joomla! com_mailto 1.5.x through 1.5.13 has an automated mail timeout bypass.CVE-2011-49137.8The rose_parse_ccitt function in net/rose/rose_subr.c in the Linux kernel before 2.6.39 does not validate the FAC_CCITT_DEST_NSAP and FAC_CC CVE-2011-49146.4The ROSE protocol implementation in the Linux kernel before 2.6.39 does not verify that certain data-length values are consistent with the a CVE-2011-49155.5fs/proc/base.c in the Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /proc/interrupts.CVE-2011-49165.5Linux kernel through 3.1 allows local users to obtain sensitive keystroke information via access to /dev/pts/ and /dev/tty*.CVE-2011-49175.5In the Linux kernel through 3.1 there is an information disclosure issue via /proc/stat.CVE-2011-49184.3Multiple cross-site scripting (XSS) vulnerabilities in Elxis CMS 2009.2, 2009.3 and 2009.3 Aphrodite before revision 2684 allow remote attac