Export limit exceeded: 425852 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1

Export CSV
CVE-2021-24253

Classyfrieds <= 3.8 - Authenticated Arbitrary File Upload to RCE

The Classyfrieds WordPress plugin through 3.8 does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed
Vendors
Classyfrieds Project
Products
Classyfrieds