CVE-2011-10011: Webid

Critical severity, CVSS 10.0. EPSS: 2.4% chance of exploitation in the next 30 days.

WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is written directly into includes/currencies.php. This allows unauthenticated attackers to inject arbitrary PHP code, resulting in persistent remote code execution when the modified script is accessed or included by the application.

Affected products

• Webid Webid: up to and including 1.0.2

Published 2025-08-13. Last modified 2026-06-16.