CVE-2012-4926
medium
CVSS v3
—
CVSS v2
6.4
VIR risk
6.4
Description
approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activation of administrators via the u parameter in an (1) app0 (disable) or (2) app1 (enable) action.
Predictions
Exploit likelihood
20%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| imgpals | img_pals_photo_host | 1.0 | |
References
CWEs
CWE-287
Verify integrity in audit chain (admin only). AS-IS.