CVE-2006-3531: Pivot

High severity, CVSS 7.5. EPSS: 9.5% chance of exploitation in the next 30 days.

includes/editor/insert_image.php in Pivot 1.30 RC2 and earlier creates the authentication credentials from parameters, which allows remote attackers to obtain privileges and upload arbitrary files via modified (1) pass and (2) session parameters, and (3) pass and (4) userlevel indices of the (a) Pivot_Vars[] or (b) Users[] array parameters.

Affected products

• Pivot Pivot: up to and including 1.30_rc2

Published 2006-07-12. Last modified 2026-06-16.