CVE-2021-25078CWE-79

CVE-2021-25078: falha em Affiliates Manager

Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting

Publicada em · Atualizada em

18Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendepss 2.3%
probabilidade de exploração
2.3%top 17% das CVEs
exploração observada
nãonenhuma fonte reporta
The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests.
Produtos afetados
Unknown · Affiliates Manager
CVEs relacionadas — Affiliates Manager

No mesmo produto, das mais perigosas para as menos.

CVE-2021-24844—Affiliate Manager < 2.8.7 - Admin+ SQL injectionEPSS 1.5%CVE-2022-2798—Affiliates Manager < 2.9.14 - Affiliate CSV InjectionEPSS 1.2%CVE-2022-2799—Affiliates Manager < 2.9.14 - Admin+ Stored Cross-Site ScriptingEPSS 0.7%
Referências
https://plugins.trac.wordpress.org/changeset/2648196https://wpscan.com/vulnerability/d4edb5f2-aa1b-4e2d-abb4-76c46def6c6e