{"id":"CVE-2011-4908","published":"2020-02-12T21:17:10Z","modified":"2024-08-07T00:23:38Z","title":"TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php","vendor":"Joomla!","product":"TinyBrowser Plugin","tier":"core","eol":null,"affectedVersions":[{"vendor":"Joomla!","product":"TinyBrowser Plugin","versions":["1.5.12","fixed in 1.5.13"]}],"description":{"text":"TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php.","provenance":"source","from":"CVE.org"},"summary":{"text":"The TinyBrowser plugin for Joomla! before version 1.5.13 contains a flaw in its upload.php component that permits arbitrary file upload. An attacker can exploit it to upload files of their choosing to the affected server, with the specific network access, authentication, user interaction, and configuration requirements not stated in the available data.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:21:04Z"},"cvss":null,"epss":{"score":0.55769,"percentile":0.99038,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.openwall.com/lists/oss-security/2011/12/25/7","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://vulmon.com/vulnerabilitydetails?qid=CVE-2011-4908","tags":["x_refsource_MISC"]},{"url":"https://www.exploit-db.com/exploits/9926","tags":["exploit","x_refsource_EXPLOIT-DB"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2011-4819","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2011-4819","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":9296,"url":"https://www.exploit-db.com/exploits/9296","title":"TinyBrowser (TinyMCE Editor File browser) 1.41.6 - Multiple Vulnerabilities","type":"webapps","platform":"php","date":"2009-07-28","verified":true,"provenance":"source"},{"id":9926,"url":"https://www.exploit-db.com/exploits/9926","title":"Joomla! Plugin tinybrowser 1.5.12 - Arbitrary File Upload / Execution","type":"webapps","platform":"php","date":"2009-07-22","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2009-07-22"},"metasploit":[{"name":"Joomla 1.5.12 TinyBrowser File Upload Code Execution","module":"exploit/unix/webapp/joomla_tinybrowser","type":"exploit","disclosureDate":"2009-07-22","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/joomla_tinybrowser.rb"}],"first":{"date":"2009-07-22","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/9926"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/9926"],"flow":[],"timeline":[{"date":"2009-07-22","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-9926); later: Metasploit 2009-07-22","url":"https://www.exploit-db.com/exploits/9926","provenance":"source"},{"date":"2020-02-12","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2011-4908","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":24.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.81,"detail":"percentile 0.9904"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 Exploit-DB entries; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}