CVE-2011-10011

CVE-2011-10011 is a critical-severity vulnerability with a CVSS 4.0 base score of 10.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-94.

Key facts

Description

WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is written directly into includes/currencies.php. This allows unauthenticated attackers to inject arbitrary PHP code, resulting in persistent remote code execution when the modified script is accessed or included by the application.

Frequently asked questions

What is CVE-2011-10011?
WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is written directly into includes/currencies.php. This allows unauthenticated attackers to inject arbitrary PHP code, resulting in persistent remote code execution when the modified script is accessed or included by the application.
How severe is CVE-2011-10011?
CVE-2011-10011 has a CVSS 4.0 base score of 10.0, rated critical severity.
Is CVE-2011-10011 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2011-10011?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2011-10011 have an EU (EUVD) identifier?
Yes. CVE-2011-10011 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2011-5238.
When was CVE-2011-10011 published?
CVE-2011-10011 was published on 2025-08-13 and last updated on 2026-06-16.

References

Other CWE-94 (Code Injection) vulnerabilities

Browse all CWE-94 (Code Injection) vulnerabilities →