CVE-2021-4436criticalobserved exploitation

CVE-2021-4436: critical vulnerability in 3DPrint Lite

3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor 3DPrint Lite

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.8epss 6.6%
from disclosure to weapon
Published on NVDFeb 5
VulnCheck+28d
The 3DPrint Lite WordPress plugin before 1.9.1.5 does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as Apache.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · 3DPrint Lite
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — 3DPrint Lite

In the same product, most dangerous first.

CVE-2024-10480MEDIUM3DPrint Lite < 2.1 - Settings Update via CSRFEPSS 0.2%