CVE-2007-2822

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-05-22 · updated 2026-06-16

Description

TutorialCMS 1.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication via the (1) loggedIn and (2) activated parameters to (a) login.php, (b) headerLinks.php, (c) submit1.php, (d) myFav.php, and (e) userCP.php.

Affected products

Wavelink Media Tutorialcms: through 1.01

References

http://osvdb.org/36520
http://secunia.com/advisories/25358
http://www.vupen.com/english/advisories/2007/1903
http://www.wavelinkmedia.com/scripts/tutorialcms/
https://exchange.xforce.ibmcloud.com/vulnerabilities/34401
https://www.exploit-db.com/exploits/3963
http://osvdb.org/36520
http://secunia.com/advisories/25358
http://www.vupen.com/english/advisories/2007/1903
http://www.wavelinkmedia.com/scripts/tutorialcms/
https://exchange.xforce.ibmcloud.com/vulnerabilities/34401
https://www.exploit-db.com/exploits/3963

Get alerted when CVE-2007-2822 or the next vulnerability affects your stack