CVE-2021-24251: falha em Business Directory Plugin – Easy Listing…
Business Directory Plugin < 5.11.2 - Arbitrary Payment History Update
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.5%
The Business Directory Plugin – Easy Listing Directories for WordPress WordPress plugin before 5.11.2 suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator update arbitrary payment history, such as change their status (from pending to completed to example)
Produtos afetados
Business Directory Team · Business Directory Plugin – Easy Listing Directories for WordPressCVEs relacionadas — Business Directory Plugin – Easy Listing…
No mesmo produto, das mais perigosas para as menos.
CVE-2021-24248—Business Directory Plugin < 5.11.1 - Authenticated PHP4 Upload to RCEEPSS 1.6%CVE-2021-24249—Business Directory Plugin < 5.11.2 - Arbitrary Listing ExportEPSS 0.7%CVE-2021-24178—Business Directory Plugin < 5.11.1 - Arbitrary Add/Edit/Delete Form Field to Stored XSSEPSS 0.7%CVE-2021-24179—Business Directory Plugin < 5.11 - Arbitrary File Upload to RCEEPSS 0.7%CVE-2021-24250—Business Directory Plugin < 5.11.2 - Authenticated Stored Cross-Site ScriptingEPSS 0.6%CVE-2023-5803MEDIUMWordPress Business Directory Plugin Plugin <= 6.3.10 is vulnerable to Cross Site Request Forgery (CSRF)EPSS 0.3%