CVE-2021-24370: falha em Fancy Product Designer
Fancy Product Designer < 4.6.9 - Unauthenticated Arbitrary File Upload and RCE
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
52Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actepss 47%
da publicação à arma
Publicada no NVD21 de jun.
VulnCheck1 de jun.
The Fancy Product Designer WordPress plugin before 4.6.9 allows unauthenticated attackers to upload arbitrary files, resulting in remote code execution.
Produtos afetados
Unknown · Fancy Product DesignerCVEs relacionadas — Fancy Product Designer
No mesmo produto, das mais perigosas para as menos.
CVE-2024-0365MEDIUMFancy Product Designer < 6.1.5 - Admin+ SQL InjectionEPSS 0.6%CVE-2024-0904MEDIUMFancy Product Designer < 6.1.81 - Admin+ Cross Site ScriptingEPSS 0.6%CVE-2024-0905MEDIUMFancy Product Designer < 6.1.8 - Reflected Cross Site ScriptingEPSS 0.5%CVE-2024-0902MEDIUMFancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting via Product TitleEPSS 0.4%
Referências
https://lists.openwall.net/full-disclosure/2020/11/17/2https://seclists.org/fulldisclosure/2020/Nov/30https://wpscan.com/vulnerability/82c52461-1fdc-41e4-9f51-f9dd84962b38https://www.secpod.com/blog/critical-zero-day-flaw-actively-exploited-in-wordpress-fancy-product-designer-plugin/https://www.wordfence.com/blog/2021/06/critical-0-day-in-fancy-product-designer-under-active-attack/