CVE-2021-4415mediumCWE-352

CVE-2021-4415: falha de média gravidade em sunshinephotocart Sunshine Photo Cart – Client…

Sunshine Photo Cart <= 2.8.28 - Cross-Site Request Forgery Bypass

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.4%
The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshine_products_quicksave_post() function. This makes it possible for unauthenticated attackers to save custom post data via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Produtos afetados
sunshinephotocart · Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers
CVEs relacionadas — sunshinephotocart Sunshine Photo Cart – Client…

No mesmo produto, das mais perigosas para as menos.

CVE-2024-1294MEDIUMSunshine Photo Cart: Free Client Galleries for Photographers <= 3.0.24 - Unauthenticated Sensitive Information Exposure via InvoiceEPSS 0.7%CVE-2025-5482HIGHSunshine Photo Cart <= 3.4.11 - Authenticated (Subscriber+) Privilege EscalationEPSS 0.6%CVE-2026-104730CRITICALSunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' ParameterEPSS 0.5%