CVE-2011-10013CWE-306CWE-94

Traq 2.0–2.3 admincp/common.php RCE

Critical · published August 13, 2025

CVSS v4.0
10.0
EPSS
2%
Percentile
83.1
In the wild
Unconfirmed
What it is

Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt execution after a failed access check, allowing unauthenticated users to reach admin-only functionality. This can be exploited via plugins.php to inject and execute arbitrary PHP code.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.02303 · 83.1th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-08-13T20:54Z
EPSS history
Timeline
  • 13 AUG 20:54Z
    Traq 2.0–2.3 admincp/common.php RCE
    cvelistv5