CVE-2013-7190: Iscripts Autohoster

Medium severity, CVSS 5.0. EPSS: 3.8% chance of exploitation in the next 30 days.

Multiple directory traversal vulnerabilities in iScripts AutoHoster, possibly 2.4, allow remote attackers to read arbitrary files via the (1) tmpid parameter to websitebuilder/showtemplateimage.php, (2) fname parameter to admin/downloadfile.php, or (3) id parameter to support/admin/csvdownload.php; or (4) have an unspecified impact via unspecified vectors in support/parser/main_smtp.php.

Affected products

• Iscripts Autohoster: version 2.4 only

Published 2013-12-20. Last modified 2026-06-17.