CVE-2022-3921critical

CVE-2022-3921: critical vulnerability in Listingo

Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor Listingo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

53Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.8epss 21%
The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Listingo
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.