CVE-2021-38360CWE-22
wp-publications <= 0.0 Local File Include
High · published September 10, 2021
What it is
The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in the ~/bibtexbrowser.php file which allows attackers to include local zip files and achieve remote code execution, in versions up to and including 0.0.
The record
Technical detail
- CVSS v3.1
- 8.3 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
- CVSS v4.0
- Not supplied
- EPSS
- 0.02260 · 82.8th percentile
- Weakness
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Published
- 2021-09-10T13:35Z
EPSS history
Timeline