CVE-2010-2006

MEDIUM 6.5CVE-2010-2006 · Published 20/05/2010 · updated 16/06/2026

In short

CVE-2010-2006 is a MEDIUM (CVSS 6.5) vulnerability affecting letodms (letodms).
Chance of exploitation in the next 30 days (EPSS): 6.7%, higher than 93.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
letodms letodms	`= 1.5.0= 1.5.1= 1.6.0= 1.7.0≤ 1.7.2`	No fix yet

Description

Directory traversal vulnerability in op/op.Login.php in LetoDMS (formerly MyDMS) 1.7.2 and earlier allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.

References

osvdb.org/61834
secunia.com/advisories/38237 · Vendor Advisory
secunia.com/advisories/42900
debian.org/security/2011/dsa-2146
securityfocus.com/archive/1/508947/100/0/threaded
securityfocus.com/bid/37828
exchange.xforce.ibmcloud.com/vulnerabilities/55709
sec-consult.com/files/20100115-0_mydms_file_inclusion.txt

More vulnerabilities in letodms

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free