CVE-2015-3986
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
23Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendepss 3.4%
from disclosure to weaponsame day
Published on NVDMay 14
1st PoCApr 29
Cross-site request forgery (CSRF) vulnerability in the TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to hijack the authentication of administrators for requests that conduct directory traversal attacks via the tcp_box_path parameter in the checkout_editor_settings page to wp-admin/admin.php.
Affected products
n/a · n/apublic PoCs found — 3
exploitdbwww.exploit-db.com/exploits/36860unverifiedcve_referencepacketstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.htmlunverifiedcve_referencewww.exploit-db.com/exploits/36860/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/131673/WordPress-TheCartPress-1.3.9-XSS-Local-File-Inclusion.htmlhttps://wordpress.org/plugins/thecartpress/changelog/https://www.exploit-db.com/exploits/36860/https://www.htbridge.com/advisory/HTB23254http://www.securityfocus.com/archive/1/535396/100/0/threadedhttp://www.securityfocus.com/bid/74395