7.2
Élevée
CVE-2022-2711 The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in…
Description
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Import any XML or CSV File to WordPress 3.6 | premières → < 3.6.9 | 3.6.9 |
Autres CVE de Import any XML or CSV File to WordPress
Les 5 CVE de Import any XML or CSV File to WordPress →
CVE-2023-7082
The Import any XML or CSV File to WordPress plugin before 3.7.3 accepts all zip files and automatically extracts the zip…
7.2
Élevée
CVE-2022-3418
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are…
7.2
Élevée
CVE-2022-2268
The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip…
Non notée
CVE-2021-24714
The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier…
Non notée