Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2022-50956

WordPress Plugin amministrazione-aperta 3.7.3 Local File Read

WordPress Plugin amministrazione-aperta 3.7.3 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting insufficient input validation in the open parameter. Attackers can supply file paths through the open GET parameter in dispatcher.php to include and read sensitive files accessible to the web server.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Amministrazione Aperta Project Wordpress
Products
Amministrazione Aperta Wordpress
CVE-2022-1560

Amministrazione Aperta < 3.8 - Admin+ LFI

The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected code is not reached. The issue can be exploited via the dashboard when logged in as an admin, or by making a logged in admin open a malicious link

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Amministrazione Aperta Project
Products
Amministrazione Aperta