CVE-2010-1996: Multiple cross-site scripting (XSS) vulnerabilities in index.php in TomatoCMS before 2.0.5 allow remote aut...

Security readout for executives and security teams

CVE-2010-1996 is an authenticated cross-site scripting issue in TomatoCMS before 2.0.5. A user with specific creation privileges could inject script or HTML through poll, category, or tag creation fields. Business risk is mainly browser-side compromise, content abuse, and possible trust damage inside affected CMS workflows. Exposure is limited to environments still running TomatoCMS before 2.0.5, especially where lower-trust authenticated users can create polls, categories, or tags. The provided affected CPE data is incomplete, so inventory validation is required. Treat this as a legacy CMS hygiene issue unless TomatoCMS before 2.0.5 is still in use. If present, prioritize remediation where untrusted authenticated contributors exist or the CMS supports public-facing business content. Mitigation focus: Upgrade TomatoCMS to version 2.0.5 or later if vendor guidance confirms availability.; Restrict poll, category, and tag creation privileges to trusted users.; Review vendor or archived advisory guidance before changing production controls..

Prepared

Jun 28, 2026, 02:49 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.