CVE-2021-24684CWE-78

PDF Light Viewer < 1.4.12 - Authenticated Command Injection

published October 18, 2021

CVSS
—
EPSS
4%
Percentile
91.0
In the wild
Unconfirmed
What it is

The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04267 · 91.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2021-10-18T13:45Z
EPSS history
Timeline
  • 18 OCT 13:45Z
    PDF Light Viewer < 1.4.12 - Authenticated Command Injection
    cvelistv5