CVE-2015-10140: high-severity vulnerability in Ajax Load More
Ajax Load More < 2.8.1.2 - Subscriber+ File Upload & Deletion
Published · Updated
36Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 8.8epss 1.4%
from disclosure to weapon0 days
Published on NVDJul 22
metasploitOct 10
exploitation probability
1.4%top 28% of all CVEs
observed exploitation
nono source reports it
The Ajax Load More plugin before 2.8.1.2 does not have authorisation in some of its AJAX actions, allowing any authenticated users, such as subscriber, to upload and delete arbitrary files.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Ajax Load MoreRelated CVEs — Ajax Load More
In the same product, most dangerous first.