Exploitation Summary
EIP tracks 1 public exploit for CVE-2010-2282. PoCs published by 10n1z3d.
AI-analyzed exploit summary This is a proof-of-concept for multiple CSRF vulnerabilities in TomatoCMS 2.0.5, demonstrating password changes, admin user creation, user deactivation, and administrator logout via crafted HTML forms.
Description
Cross-site request forgery (CSRF) vulnerability in TomatoCMS 2.0.6 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password.
Exploits (1)
exploitdb
WORKING POC
by 10n1z3d · htmlwebappsphp
https://www.exploit-db.com/exploits/14331
This is a proof-of-concept for multiple CSRF vulnerabilities in TomatoCMS 2.0.5, demonstrating password changes, admin user creation, user deactivation, and administrator logout via crafted HTML forms.
Classification
Working Poc 100%
Attack Type
Auth Bypass
Complexity
Trivial
Reliability
Reliable
Target:
TomatoCMS 2.0.5
No auth needed
Prerequisites:
Victim must be authenticated as an administrator in TomatoCMS · Attacker must trick the victim into visiting a malicious page
devstral-2 · analyzed Feb 16, 2026
Full analysis →
References (2)
Core 2
Core References
Various Sources x_refsource_misc
http://holisticinfosec.org/content/view/148/45/
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/39680
Scores
EPSS
0.0079
EPSS Percentile
51.4%
Details
CWE
CWE-352
Status
published
Products (1)
tomatocms/tomatocms
2.0.6
Published
Jun 15, 2010
Tracked Since
Feb 18, 2026