CVE-2021-24370: fallo en Fancy Product Designer
Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
52Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actepss 47%
de la publicación al arma
Publicada en NVD21 jun
VulnCheck1 jun
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
Productos afectados
Unknown · Fancy Product DesignerCVEs relacionadas — Fancy Product Designer
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-0365MEDIUMFancy Product Designer < 6.1.5 - Admin+ SQL InjectionEPSS 0.6%CVE-2024-0904MEDIUMFancy Product Designer < 6.1.81 - Admin+ Cross Site ScriptingEPSS 0.6%CVE-2024-0905MEDIUMFancy Product Designer < 6.1.8 - Reflected Cross Site ScriptingEPSS 0.5%CVE-2024-0902MEDIUMFancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting via Product TitleEPSS 0.4%
Referencias
https://lists.openwall.net/full-disclosure/2020/11/17/2https://seclists.org/fulldisclosure/2020/Nov/30https://wpscan.com/vulnerability/82c52461-1fdc-41e4-9f51-f9dd84962b38https://www.secpod.com/blog/critical-zero-day-flaw-actively-exploited-in-wordpress-fancy-product-designer-plugin/https://www.wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack/