TUTOS 1.3 does not restrict access to php/admin/cmd.php, which allows remote attackers to execute arbitrary shell commands via the cmd parameter in a direct request.
CVSS Score
10.0
EPSS Score
0.06
Published
2008-01-09
TUTOS 1.3 allows remote attackers to read system information via a direct request to php/admin/phpinfo.php, which calls the phpinfo function.
CVSS Score
5.0
EPSS Score
0.066
Published
2008-01-09