CVE-2010-1003: Efrontlearning Efront

Medium severity, CVSS 6.8. EPSS: 5% chance of exploitation in the next 30 days.

Directory traversal vulnerability in www/editor/tiny_mce/langs/language.php in eFront 3.5.x through 3.5.5 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the langname parameter.

Affected products

• Efrontlearning Efront: version 3.5.0 only; version 3.5.1 only; version 3.5.2 only; version 3.5.3 only; version 3.5.4 only; version 3.5.5 only

Published 2010-03-19. Last modified 2026-06-16.