CVE-2012-0934

2012-01-2904:04:44

CWE-94

[email protected]

web.nvd.nist.gov

cve-2012-0934

php

remote file inclusion

vulnerability

ajax

savetag.php

theme tuner

wordpress

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7.8 High

AI Score

Confidence

Low

0.021 Low

EPSS

Percentile

89.1%

JSON

PHP remote file inclusion vulnerability in ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the tt-abspath parameter.

Affected configurations

NVD

Node

zingiritheme_tuner_pluginRange≤0.7

zingiritheme_tuner_pluginMatch0.1

zingiritheme_tuner_pluginMatch0.2

zingiritheme_tuner_pluginMatch0.3

zingiritheme_tuner_pluginMatch0.4

zingiritheme_tuner_pluginMatch0.6

AND

wordpresswordpress

CPENameOperatorVersion
zingiri:theme_tuner_pluginzingiri theme tuner pluginle0.7
zingiri:theme_tuner_pluginzingiri theme tuner plugineq0.1
zingiri:theme_tuner_pluginzingiri theme tuner plugineq0.2
zingiri:theme_tuner_pluginzingiri theme tuner plugineq0.3
zingiri:theme_tuner_pluginzingiri theme tuner plugineq0.4
zingiri:theme_tuner_pluginzingiri theme tuner plugineq0.6

CPE	Name	Operator	Version
zingiri:theme_tuner_plugin	zingiri theme tuner plugin	le	0.7
zingiri:theme_tuner_plugin	zingiri theme tuner plugin	eq	0.1
zingiri:theme_tuner_plugin	zingiri theme tuner plugin	eq	0.2
zingiri:theme_tuner_plugin	zingiri theme tuner plugin	eq	0.3
zingiri:theme_tuner_plugin	zingiri theme tuner plugin	eq	0.4
zingiri:theme_tuner_plugin	zingiri theme tuner plugin	eq	0.6