CVE-2012-10049
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-08

Last updated on: 2025-08-08

Assigner: VulnCheck

Description
WebPageTest version 2.6 and earlier contains an arbitrary file upload vulnerability in the resultimage.php script. The application fails to validate or sanitize user-supplied input before saving uploaded files to a publicly accessible directory. This flaw allows remote attackers to upload and execute arbitrary PHP code, resulting in full remote code execution under the web server context.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-08
Last Modified
2025-08-08
Generated
2026-05-06
AI Q&A
2025-08-08
EPSS Evaluated
2026-05-05
NVD
CVE-2012-10049
EUVD
EUVD-2012-6593
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
webpagetest webpagetest 2.6
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in WebPageTest version 2.6 and earlier, where the resultimage.php script allows arbitrary file uploads without validating or sanitizing user input. This means an attacker can upload malicious PHP code to a publicly accessible directory, enabling them to execute that code remotely on the web server.


How can this vulnerability impact me? :

The vulnerability can lead to full remote code execution on the web server, allowing attackers to run arbitrary commands or scripts. This can compromise the server, lead to data theft, service disruption, or further attacks within the network.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart