CVE-2013-2184
HighSummary
Movable Type before 5.2.6 does not properly use the Storable::thaw function, allowing remote attackers to execute arbitrary code via the comment_state parameter.
Risk Assessment
Attackers can exploit this vulnerability to execute arbitrary code remotely, potentially leading to system compromise or data leakage.
Recommendation
It is recommended to upgrade Movable Type to version 5.2.6 or later to mitigate this vulnerability.
Other vulnerabilities in Movable Type
See all- CVE-2026-33088Critical
Movable Type by Six Apart Ltd. contains an SQL injection vulnerability that may allow an attacker to execute arbitrary SQL statements.
- CVE-2026-44392Medium
Missing authorization in Movable Type allows a user without admin privileges to perform unintended updates after signing in.
Original NVD description (English source)
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.