CVE-2021-24254CWE-434

CVE-2021-24254: fallo en College publisher Import

College Publisher Import <= 0.1 - Arbitrary File Upload to RCE

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear College publisher Import

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

3Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackepss 1.8%
The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack.
Productos afectados
Unknown · College publisher Import