654 matches found
SUSE CVE-2018-17246
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with...
Design/Logic Flaw
The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non PHP files and retrieve their...
CVE-2023-0080
The CVE-2023-0080 entry concerns the WordPress plugin Customer Reviews for WooCommerce (pre-5.16.0). The vulnerability arises from a deficient validation of a shortcode attribute, enabling users with a contributor role or higher to perform Local File Inclusion by traversing attributes to read arb...
PT-2023-15995 · WordPress · Customer Reviews For Woocommerce
Name of the Vulnerable Software and Affected Versions: Customer Reviews for WooCommerce WordPress plugin versions prior to 5.16.0 Description: The issue allows users with a contributor role and above to include arbitrary files via a traversal attack due to a lack of validation in one of its...
CVE-2022-4063: Improper Limitation of a Pathname to a Restricted Directory
The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers...
GHSA-M8GQ-83GH-V42V XML External Entities Vulnerability in CVRF-CSAF-Converter
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities XXE. This leads to the inclusion of arbitrary local file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter...
XML External Entities Vulnerability in CVRF-CSAF-Converter
CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities XXE. This leads to the inclusion of arbitrary local file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter...
CVE-2021-25053
The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE...
CVE-2021-25051
The Modal Window WordPress plugin before 5.2.2 within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE...
CVE-2021-25052
The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE...
CVE-2021-25053
The WP Coder WordPress plugin before 2.5.2 within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE...
CVE-2021-25052
CVE-2021-25052 affects the WordPress Button Generator plugin (pre-2.3.3) in the wow-company admin menu. A flaw in how include() handles PHP files (and data:///http:// resources) enables remote file inclusion, which can lead to CSRF and remote code execution. Remediation: upgrade to version 2.3.3 ...
CVE-2021-25053
The CVE-2021-25053 entry concerns the WordPress WP Coder plugin prior to version 2.5.2. According to multiple sources in the connected documents, the wow-company admin menu page allows include() of arbitrary files with a PHP extension (including data:// or http://), enabling CSRF-facilitated remo...
CVE-2021-25052 Button Generator < 2.3.3 - RFI leading to RCE via CSRF
The Button Generator WordPress plugin before 2.3.3 within the wow-company admin menu page allows to include arbitrary file with PHP extension as well as with data:// or http:// protocols, thus leading to CSRF RCE...
CVE-2021-25051
The CVE concerns the WordPress Modal Window plugin (before 5.2.2). The vulnerability arises from the wow-company admin page calling include() on arbitrary PHP files (also via data:// or http://), enabling CSRF-driven remote code execution (RCE). Affected versions are before 5.2.2; remediation is ...
PT-2022-9608
Name of the Vulnerable Software and Affected Versions The Button Generator WordPress plugin versions prior to 2.3.3 Description The issue allows for the inclusion of arbitrary files with PHP extension, as well as files using the data:// or http:// protocols, within the wow-company admin menu page...
PT-2022-9609
Name of the Vulnerable Software and Affected Versions WP Coder WordPress plugin versions prior to 2.5.2 Description The issue allows for the inclusion of arbitrary files with PHP extension, as well as files using data:// or http:// protocols, within the wow-company admin menu page. This can lead ...
PT-2022-9607
Name of the Vulnerable Software and Affected Versions The Modal Window WordPress plugin versions prior to 5.2.2 Description The issue allows for the inclusion of arbitrary files with PHP extension, as well as files using the data:// or http:// protocols, within the wow-company admin menu page. Th...
SuiteCRM 路径遍历漏洞
SuiteCRM, a customer relationship management system from the SuiteCRM Suitecrm team, has a security vulnerability that could allow an attacker to include arbitrary files via the importFile parameter portion of the RefreshMapping import function...