CVE-2005-4600

Severity: medium (CVSS 6.4 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-12-31 · updated 2026-06-16
Weakness: CWE-22

Description

Directory traversal vulnerability in tiny_mce_gzip.php in TinyMCE Compressor PHP before 1.06 allows remote attackers to read or include arbitrary files via a trailing null byte (%00) in the (1) theme, (2) language, (3) plugins, or (4) lang parameter.

Affected products

Moxiecode Tinymce Compressor Php: through 1.05

References

http://secunia.com/advisories/18262
http://securityreason.com/securityalert/306
http://securitytracker.com/id?1015424
http://tinymce.moxiecode.com/punbb/viewtopic.php?id=2233
http://tinymce.moxiecode.com/punbb/viewtopic.php?id=2244
http://www.hardened-php.net/advisory_262005.111.html
http://www.osvdb.org/22116
http://www.securityfocus.com/archive/1/420543/100/0/threaded
http://www.securityfocus.com/bid/16083
https://exchange.xforce.ibmcloud.com/vulnerabilities/36736
https://www.exploit-db.com/exploits/4441
http://secunia.com/advisories/18262

Get alerted when CVE-2005-4600 or the next vulnerability affects your stack