CVE-2007-2822
CVE-2007-2822 is a critical-severity vulnerability in Wavelink Media Tutorialcms with a CVSS 2.0 base score of 9.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Critical (CVSS 2.0 base score 9.3)
- EPSS exploit prediction: 4% (90th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Wavelink Media Tutorialcms
- Published:
- Last modified:
Description
TutorialCMS 1.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication via the (1) loggedIn and (2) activated parameters to (a) login.php, (b) headerLinks.php, (c) submit1.php, (d) myFav.php, and (e) userCP.php.
Frequently asked questions
- What is CVE-2007-2822?
- TutorialCMS 1.01 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication via the (1) loggedIn and (2) activated parameters to (a) login.php, (b) headerLinks.php, (c) submit1.php, (d) myFav.php, and (e) userCP.php.
- How severe is CVE-2007-2822?
- CVE-2007-2822 has a CVSS 2.0 base score of 9.3, rated critical severity.
- Is CVE-2007-2822 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (90th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2007-2822?
- CVE-2007-2822 affects Wavelink Media Tutorialcms. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2007-2822?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2007-2822 published?
- CVE-2007-2822 was published on 2007-05-22 and last updated on 2026-06-16.
References
- http://osvdb.org/36520
- http://secunia.com/advisories/25358
- http://www.vupen.com/english/advisories/2007/1903
- http://www.wavelinkmedia.com/scripts/tutorialcms/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34401
- https://www.exploit-db.com/exploits/3963
Affected products (1)
- cpe:2.3:a:wavelink_media:tutorialcms:*:*:*:*:*:*:*:*
More vulnerabilities in Wavelink Media Tutorialcms
- CVE-2007-2599 — High (CVSS 7.5): Multiple SQL injection vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow remote attackers…
- CVE-2008-0254 — Medium (CVSS 6.8): SQL injection vulnerability in activate.php in TutorialCMS (aka Photoshop Tutorials) 1.02, when magic_quotes_gpc is…
- CVE-2007-2600 — Medium (CVSS 6.8): Multiple cross-site scripting (XSS) vulnerabilities in TutorialCMS (aka Photoshop Tutorials) 1.00 and earlier allow…