CVE-2023-0291: fallo de gravedad alta en expresstech Quiz and Survey Master (QSM)…
Quiz And Survey Master <= 8.0.8 - Unauthenticated Arbitrary Media Deletion
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.2epss 2.0%
The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for unauthenticated attackers to delete arbitrary media files.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
Productos afectados
expresstech · Quiz and Survey Master (QSM) – Easy Quiz and Survey MakerCVEs relacionadas — expresstech Quiz and Survey Master (QSM)…
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-4032HIGHQuiz and Survey Master <= 8.0.4 - Unauthenticated iFrame Injection via Paragraph and Short AnswerEPSS 0.8%CVE-2023-0292MEDIUMQuiz And Survey Master <= 8.0.8 - Cross-Site Request Forgery to Arbitrary Media DeletionEPSS 0.8%CVE-2022-4033MEDIUMQuiz and Survey Master <= 8.0.4 - Improper Input ValidationEPSS 0.8%CVE-2026-5797MEDIUMQuiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input FieldsEPSS 0.5%CVE-2026-9230MEDIUMQuiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structureEPSS 0.5%CVE-2024-3592CRITICALQuiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL InjectionEPSS 0.5%