CVE-2015-10133highCWE-98

CVE-2015-10133: high-severity vulnerability in markjaquith Subscribe to Comments

Subscribe to Comments <= 2.1.2 - Local File Includion

Published · Updated

Follow this CVE+ Monitor Subscribe to Comments

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

36Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.2epss 2.4%
The Subscribe to Comments for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.2 via the Path to header value. This allows authenticated attackers, with administrative privileges and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This same function can also be used to execute arbitrary PHP code.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
markjaquith · Subscribe to Comments
Related CVEs — markjaquith Subscribe to Comments

In the same product, most dangerous first.

CVE-2024-8792MEDIUMSubscribe to Comments <= 2.3 - Reflected Cross-Site ScriptingEPSS 0.4%