CVE-2011-10013 CRITICAL

CVE-2011-10013: Traq 2.0–2.3 admincp/common.php RCE

Vendor Traq Project
Product Issue Tracking System
Weakness CWE-94 · Code injection
Published August 13, 2025
Last update May 25, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt execution after a failed access check, allowing unauthenticated users to reach admin-only functionality. This can be exploited via plugins.php to inject and execute arbitrary PHP code.

Key dates

02Disclosure timeline

August 13, 2025 CVE published
May 25, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-4506 Mindinventory MindSQL mindsql_core.py ask_db code injection CVE-2025-14509 Lucky Wheel for WooCommerce – Spin a Sale <= 1.1.13 - Authenticated (Administrator+) PHP Code Injection via Conditional Tags CVE-2026-45714 CubeCart: Server-Side Template Injection (SSTI) in Smarty Templates leading to RCE CVE-2025-64691 AVEVA Process Optimization Code Injection CVE-2026-35178 Workbench Affected by Remote Code Execution (RCE) via Malicious Cookie in Timezone Conversion