Lucene search
PRIOn knowledge basePRION:CVE-2020-35932HistoryJan 01, 2021 - 2:15 a.m.
Deserialization of untrusted data
2021-01-0102:15:00
PRIOn knowledge base
www.prio-n.com
2
Insecure Deserialization in the Newsletter plugin before 6.8.2 for WordPress allows authenticated remote attackers with minimal privileges (such as subscribers) to use the tpnc_render AJAX action to inject arbitrary PHP objects via the options[inline_edits] parameter. NOTE: exploitability depends on PHP objects that might be present with certain other plugins or themes.
| CPE | Name | Operator | Version |
|---|---|---|---|
| newsletter | lt | 6.8.2 |
Related
cve
cve
CVE-2020-35932
2021-01-01 02:15:13
nvd
nvd
CVE-2020-35932
2021-01-01 02:15:13
wpvulndb
wpvulndb
Newsletter < 6.8.2 - Authenticated PHP Object Injection
2020-08-03 00:00:00
cvelist
cvelist
CVE-2020-35932
2021-01-01 01:24:25
openvas
openvas
WordPress Newsletter Plugin < 6.8.2 Multiple Vulnerabilities
2020-08-04 00:00:00