CVE-2022-1409CWE-434

VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload

published May 16, 2022

CVSS
—
EPSS
1%
Percentile
73.6
In the wild
Unconfirmed
What it is

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01472 · 73.6th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2022-05-16T14:30Z
EPSS history
Timeline
  • 16 MAY 14:30Z
    VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload
    cvelistv5