Drupal Imce Module vulnerabilities

2 CVEs affecting Drupal Imce Module, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2006-7110, published 2007-03-05.

More from Drupal.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2006-7110, published 2007-03-05. Medium severity, CVSS 5.5. EPSS: 1.4% chance of exploitation in the next 30 days. Directory traversal vulnerability in the delete function in IMCE before 1.6, a Drupal module, allows remote authenticated users to delete arbitrary files via ".." sequences.
• CVE-2006-7109, published 2007-03-05. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. Unrestricted file upload vulnerability in IMCE before 1.6, a Drupal module, allows remote authenticated users to upload arbitrary PHP code via a filename with a double extension such as .php.gif.