CVE-2022-1409 VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload

2022-05-1614:30:58

CWE-434

WPScan

www.cve.org

vikbooking

hotel booking engine

pms

wordpress

php file upload

vulnerability

EPSS

0.001

Percentile

42.9%

JSON

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code

CNA Affected

[
  {
    "product": "VikBooking Hotel Booking Engine & PMS",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.5.8",
        "status": "affected",
        "version": "1.5.8",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/1330f8f7-4a59-4e9d-acae-21656a4101fe

EPSS

0.001

Percentile

42.9%

JSON

Related for CVELIST:CVE-2022-1409