7.2
Élevée
CVE-2022-2903 The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could…
Description
The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress 3.6 | premières → < 3.6.13 | 3.6.13 |
Autres CVE de Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress
Les 9 CVE de Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress →
CVE-2021-25066
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing…
Non notée
CVE-2021-25056
The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high…
Non notée
CVE-2021-24889
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which…
Non notée
CVE-2021-24381
The Ninja Forms Contact Form WordPress plugin before 3.5.8.2 does not sanitise and escape the custom class name of the…
Non notée