CVE-2015-10144highCWE-434

CVE-2015-10144: fallo de gravedad alta en nik00726 Thumbnail carousel slider

Responsive Thumbnail Slider < 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Thumbnail carousel slider

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

36Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 8.8epss 3.6%
de la publicación al armael mismo día
Publicada en NVD25 jul
metasploit28 ago
The Responsive Thumbnail Slider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type sanitization in the via the image uploader in versions up to 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected sites server using a double extension which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
nik00726 · Thumbnail carousel slider
CVEs relacionadas — nik00726 Thumbnail carousel slider

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-2120MEDIUMThumbnail carousel slider <= 1.1.9 - Reflected Cross-Site ScriptingEPSS 0.6%CVE-2019-25222MEDIUMThumbnail carousel slider <= 1.0.4 - Authenticated (Admin+) SQL InjectionEPSS 0.4%CVE-2023-5821MEDIUMCVE-2023-5821EPSS 0.3%