Skip to content
CVE Tracker
Back

CVE-2012-10045

XODA 0.4.5 Arbitrary PHP File Upload

Critical9.3EPSS 1.8%
Published
Updated
Reserved
Assigned by
VulnCheck

Description

XODA version 0.4.5 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary PHP code on the server. The flaw resides in the upload functionality, which fails to properly validate or restrict uploaded file types. By crafting a multipart/form-data POST request, an attacker can upload a .php file directly into the web-accessible files/ directory and trigger its execution via a subsequent GET request.

Scores

CVSS scores of CVE-2012-10045, by who scored it
Scored byCVSSScoreVector
VulnCheckCNA (assigner)4.0Critical9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
NVDNVD · Deferred4.0Critical9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
1.8% · top 22% of all CVEs (2 Nov 2026)
CISA SSVC
Exploitation: poc · Automatable: yes · Technical impact: total

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.3.

Weakness

Affected products

  • XODA · XODA

    • affected 0.4.5

References (6)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .