Tomatocms is a narrowly scoped, open-source content-management system that presents a focused but recurring set of application-layer vulnerabilities centered on its single product. The exposure clusters around web-input handling flaws—cross-site scripting, cross-site request forgery, and SQL injection—that are characteristic of CMS platforms, and public exploit code is frequently available for disclosed issues. Current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Tomatocms over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2010-1994HIGH SQL injection vulnerability in index.php in TomatoCMS before 2.0.5 allows remote attackers to execute arbitrary SQL commands via the q parameter in conjunction with a /news/search | May 20, 2010 | 7.5 | 30 | NO | YES |
CVE-2010-2282MEDIUM Cross-site request forgery (CSRF) vulnerability in TomatoCMS 2.0.6 allows remote attackers to hijack the authentication of administrators for requests that change the administrativ | Jun 15, 2010 | 5.1 | 24 | NO | YES |
CVE-2010-1514MEDIUM Unrestricted file upload vulnerability in TomatoCMS 2.0.6 and earlier allows remote authenticated users, with certain privileges, to execute arbitrary PHP code by uploading an imag | Jun 15, 2010 | 6.0 | 18 | NO | NO |
CVE-2010-2281MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS 2.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) keyword or (2) banneri | Jun 15, 2010 | 4.3 | 15 | NO | NO |
Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS 2.0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) keyword or | Jun 15, 2010 | 2.6 | 13 | NO | NO |
Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with "Add new article" privileges, to inject arbitrary | May 20, 2010 | 2.1 | 13 | NO | NO |
Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote authenticated users, with certain creation privileges, to inject arbitrary w | May 20, 2010 | 2.1 | 12 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Tomatocms.
Media articles that mention a CVE ID that affects a product developed by Tomatocms — matched by CVE ID, not by vendor name.