CVE-2013-7190

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2013-12-20 · updated 2026-06-17
Weakness: CWE-22

Description

Multiple directory traversal vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to read arbitrary files via the (1) tmpid parameter to websitebuilder/showtemplateimage.php, (2) fname parameter to admin/downloadfile.php, or (3) id parameter to support/admin/csvdownload.php; or (4) have an unspecified impact via unspecified vectors in support/parser/main_smtp.php.

Affected products

Iscripts Autohoster: 2.4

References

http://seclists.org/fulldisclosure/2013/Dec/121
https://exchange.xforce.ibmcloud.com/vulnerabilities/89818
http://seclists.org/fulldisclosure/2013/Dec/121
https://exchange.xforce.ibmcloud.com/vulnerabilities/89818

Get alerted when CVE-2013-7190 or the next vulnerability affects your stack