CVE-2020-36714: falha de alta gravidade em themefusecom Brizy – Page Builder
Brizy < 1.0.126 - Authorization Bypass to Settings Updates
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
43Vexday Risk Score
Priorize a correção. Ela exploração observada pelo VulnCheck.
ssvc Actcvss 7.4epss 0.5%
da publicação à arma
Publicada no NVD20 de out.
VulnCheck3 de jun.
The Brizy plugin for WordPress is vulnerable to authorization bypass due to a incorrect capability check on the is_administrator() function in versions up to, and including, 1.0.125. This makes it possible for authenticated attackers to access and interact with available AJAX functions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Produtos afetados
themefusecom · Brizy – Page BuilderCVEs relacionadas — themefusecom Brizy – Page Builder
No mesmo produto, das mais perigosas para as menos.
CVE-2024-1311HIGHBrizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Arbitrary File UploadEPSS 1.5%CVE-2024-3242HIGHBrizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File UploadEPSS 1.0%CVE-2024-10960CRITICALBrizy – Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploadsEPSS 0.9%CVE-2024-1165MEDIUMBrizy – Page Builder <= 2.4.39 - Authenticated (Contributor+) Directory TraversalEPSS 0.8%CVE-2024-1296MEDIUMBrizy – Page Builder <= 2.4.40 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.5%CVE-2026-5324HIGHBrizy – Page Builder <= 2.8.11 - Unauthenticated Stored Cross-Site Scripting via FileUpload Field ValueEPSS 0.4%