PHP remote file inclusion vulnerability in manager/media/browser/mcpuk/connectors/php/Commands/Thumbnail.php in Modx CMS 0.9.2.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the base_path parameter. NOTE: it is possible that this is a vulnerability in FCKeditor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Modxcms | Modxcms | * | 0.9.2.1 (including) |
| Modxcms | Modxcms | 0.9.1 (including) | 0.9.1 (including) |