EUVD-2020-21361

Malware in sbrugna...

EUVD-2022-43602

Malicious code in bioql PyPI...

EUVD-2024-22458

Malicious code in bioql PyPI...

Malicious code in test-mlw2-whops-canto (npm)

The package test-mlw2-whops-canto was found to contain malicious code...

MAL-2025-34822 Malicious code in test-mlw1-whops-canto (npm)

The package test-mlw1-whops-canto was found to contain malicious code...

MAL-2025-36631 Malicious code in test-mlw2-whops-canto (npm)

The package test-mlw2-whops-canto was found to contain malicious code...

Malicious code in test-mlw1-whops-canto (npm)

The package test-mlw1-whops-canto was found to contain malicious code...

Malicious code in @malware-test-whops-canto/test-mlw3-whops-canto (npm)

The package @malware-test-whops-canto/test-mlw3-whops-canto was found to contain malicious code...

MAL-2025-9072 Malicious code in @malware-test-whops-canto/test-mlw3-whops-canto (npm)

The package @malware-test-whops-canto/test-mlw3-whops-canto was found to contain malicious code...

CVE-2023-3452

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wpabspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allowurlinclude is enabled. Local File...

CVE-2022-40305

A Server-Side Request Forgery issue in Canto Cumulus through 11.1.3 allows attackers to enumerate the internal network, overload network resources, and possibly have unspecified other impact via the server parameter to the /cwc/login login form...

CVE-2020-28978

The Canto plugin 1.3.0 for WordPress contains blind SSRF vulnerability. It allows an unauthenticated attacker can make a request to any internal and external server via /includes/lib/tree.php?subdomain=SSRF...

CVE-2020-24063

The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF...

CVE-2024-25096

Improper Control of Generation of Code 'Code Injection' vulnerability in Canto Inc. Canto allows Code Injection.This issue affects Canto: from n/a through 3.0.7...

CVE-2024-4936

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allowurlinclude to be...

CVE-2024-4936

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allowurlinclude to be...

CVE-2024-4936

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allowurlinclude to be...

EUVD-2024-44502

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allowurlinclude to be...

CVE-2024-4936 Canto <= 3.0.8 - Unauthenticated Remote File Inclusion

The Canto plugin for WordPress is vulnerable to Remote File Inclusion in all versions up to, and including, 3.0.8 via the abspath parameter. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. This required allowurlinclude to be...

CVE-2024-4936

CVE-2024-4936 affects the Canto WordPress plugin (versions ≤ 3.0.8). It allows unauthenticated Remote File Inclusion via the abspath parameter, requiring allow_url_include to be enabled to exploit, leading to potential code execution. Remediation per connected docs: upgrade to a version newer tha...