CVE-2023-24676

ProcessWire 3.0.210 is affected by a vulnerable download_zip_url parameter used when installing a new module, which can allow arbitrary code execution and a reverse shell. The Red Hat, Veracode, OSV, and related entries concur with the core issue; exploitation is described as requiring admin priv...

CVE-2024-41597

ProcessWire v3.0.229 is vulnerable to Cross-Site Request Forgery via its comments functionality, allowing a remote attacker to execute arbitrary code through a crafted HTML file. The connected PT-Security entry recommends updating to a newer version that includes a fix. No exploit details are pro...