CVE-2010-1995: Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote aut...

Security readout for executives and security teams

TomatoCMS versions before 2.0.5 let an authenticated user with article-creation rights store malicious script or HTML in article metadata. The business risk is account/session compromise or malicious content shown to administrators or site visitors, depending on where those fields render. Exposure is likely limited to sites still running TomatoCMS before 2.0.5 and allowing authenticated users to create news articles. Public internet exposure increases business impact, but the cited evidence requires an authenticated privileged user. Treat this as a targeted cleanup item, not an emergency, unless legacy TomatoCMS is still internet-facing or many users can create articles. Prioritize upgrade or decommissioning because the product/version is very old. Mitigation focus: Upgrade TomatoCMS installations from versions before 2.0.5.; Check current vendor or project guidance for supported remediation.; Restrict "Add new article" privileges to trusted users only..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.