CVE-2021-46114

2022-01-2619:15:08

Google

osv.dev

7 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.6%

JSON

jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.

CPENameOperatorVersion
jpresseq2.0-rc.8
jpresseq1.0.1
jpresseq4.0.2
jpresseq3.2.5
jpresseq4.0.6
jpresseq1.0.4
jpresseq2.0-rc.4
jpresseq2.0-rc.1
jpresseq0.0.2
jpresseq1.0