CVE-2010-0988

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-03-26 · updated 2026-06-16
Weakness: CWE-94

Description

Multiple unspecified vulnerabilities in Pulse CMS before 1.2.3 allow (1) remote attackers to write to arbitrary files and execute arbitrary PHP code via vectors related to improper handling of login failures by includes/login.php; and allow remote authenticated users to write to arbitrary files and execute arbitrary PHP code via vectors involving the (2) filename and (3) block parameters to view.php.

Affected products

Pulsecms Pulse Cms: through 1.2.2; 1.0, 1.1, 1.01, 1.2, 1.2.1, 1.15 (+3)

References

http://secunia.com/advisories/39011
http://secunia.com/secunia_research/2010-45/
http://secunia.com/secunia_research/2010-51/
http://www.osvdb.org/63166
http://www.osvdb.org/63168
http://www.securityfocus.com/archive/1/510299/100/0/threaded
http://www.securityfocus.com/archive/1/510300/100/0/threaded
http://www.securityfocus.com/bid/38956
http://secunia.com/advisories/39011
http://secunia.com/secunia_research/2010-45/
http://secunia.com/secunia_research/2010-51/
http://www.osvdb.org/63166

Get alerted when CVE-2010-0988 or the next vulnerability affects your stack