CVE-2011-10011CWE-94

WeBid 1.0.2 converter.php Remote PHP Code Injection

Critical · published August 13, 2025

CVSS v4.0
10.0
EPSS
2%
Percentile
84.2
In the wild
Unconfirmed
What it is

WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is written directly into includes/currencies.php. This allows unauthenticated attackers to inject arbitrary PHP code, resulting in persistent remote code execution when the modified script is accessed or included by the application.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.02458 · 84.2th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-08-13T20:55Z
EPSS history
Timeline
  • 13 AUG 20:55Z
    WeBid 1.0.2 converter.php Remote PHP Code Injection
    cvelistv5