Lucene search
WpvulndbWPVDB-ID:5D498CDE-F352-4BDC-8972-B66B484BFB14HistoryJul 05, 2022 - 12:00 a.m.
Visualizer: Tables and Charts Manager for WordPress < 3.7.10 - Contributor+ PHAR Deserialization
2022-07-0500:00:00
wpscan.com
7
3.8 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
The plugin does not validate the ‘remote_data’ parameter allowing contributor and above roles to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP objects when a POP chain is present.
| CPE | Name | Operator | Version |
|---|---|---|---|
| visualizer | lt | 3.7.10 |
Related
patchstack
patchstack
prion
prion
Cross site scripting
2022-09-01 21:15:00
cve
cve
CVE-2022-2256
2022-09-01 21:15:00
github
github
osv
osv
Keycloak vulnerable to Cross-Site Scripting (XSS)
2022-09-02 00:01:02
veracode
veracode
Cross-site Scripting (XSS)
2022-09-28 07:49:15
redhatcve
redhatcve
CVE-2022-2256
2022-06-29 20:05:41
redhat
redhat
nessus
nessus
3.8 Low
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Related for WPVDB-ID:5D498CDE-F352-4BDC-8972-B66B484BFB14